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EXECUTIVE SUMMARY 


The organised crime threat assessment (OCTA) is the basis for the development 
of strategies and action plans for countering organised crime in the US and 
many countries in Western Europe. Such assessments are now a standard tool 
to assess the scale and nature of the threats and to allow formulating political 
and operational priorities for countering organised crime. 


The European Union (EU) Serious and Organized Crime Threat Assessment (SOCTA) 
to be produced in 2013 will be the core element of a new 2013 —- 2017 policy 
cycle in an effort to counter serious and transnational organised crime. 


The Bulgarian Serious and Organised Crime Threat Assessment is the result of a 
public-private partnership between national law enforcement institutions and the 
Center for the Study of Democracy (CSD). The assessment was supported by 
DG Combating Organised Crime (DGCOC), DG Criminal Police (GDCP), the 
National Revenue Agency (NRA), the Customs Agency, the State Agency for 
National Security (SANS). 


The current assessment draws on information provided by DGCOC, NRA and 
DGCP. Furthermore, a number of meetings and discussions were held with 
investigators from DGCOC and DGCP in the country, prosecutors, representatives 
of NRA and the Customs Agency, as well as with experts from the private sector. 
The assessment used a wide range of public record sources, statistical data, as 
well as the results from the National Crime Survey (NCS), conducted annually 
by the CSD. 


The analytical approach adopted uses the terms illegal markets and_ illegal 
activities to define the scope of the assessment of organised crime. This allows 
for the inclusion not only of threats from specific criminal groups and individu- 
als, but also a wider range of actors and threats that may be part of the legal 
economy and that require administrative and legislative measures to counter 
them. 


The period reviewed in the current assessment (2010 — 2011) was marked by 
the beginning of the economic crisis in Bulgaria. As such, it was characterized 
by a significant rise in unemployment and an increase of street crime for the 
first time in 10 years. The analysis provides an assessment of the threats from 
serious and organised crime and outlines the criminal potential, the size of the 
profits from criminal activity and trends in the development of illegal markets. 
The 12 most significant organised criminal activities generated around €1.8 bil- 
lion in annual turnover which is equivalent to 4.7% of the country’s GDP. This 
ratio to the GDP indicates that the criminal economy generates much lower 
turnover compared to the period prior to Bulgaria’s EU accession. At the same 
time, such size of the illegal economy poses a serious threat. 


Executive Summary 


The convergence of white collar and organised crime is a key threat for Bulgaria. 
This convergence has a particularly dangerous form of corporate crime, 
popularly known as “oligarchy”. During the 1990s and the early 2000s, political 
corruption facilitated the rise of such economic conglomerates, which later 
continued to use criminal methods to exploit public resources and commit 
tax crimes. In some cases, the participants in this type of “crime of the elites” 
have also been directly linked to various other forms of traditional organised 
crime (distribution of drugs, the market for prostitution, VAT and excisable goods 
fraud). 


In addition to the financial dimension of criminal markets, the level of violence 
is another critical aspect in the assessment of the actual threats from organised 
crime in the country. This problem had a strong impact on the political process 
and on the European Commission’s evaluation of the fight against organised 
crime in Bulgaria. The main reason is the use of violence by the so-called ‘vio- 
lent entrepreneurs’ during the 1990s and the large number of publicly executed 
contract killings of organised crime figures. The rates of criminal bombings and 
homicides attributed to organised crime have been on the decline since 2001, 
while the number of contract killings has been steadily falling since 2003. 


The trends in the development of organised criminal activities in 2010 - 2011 
are divergent because criminal markets adapt to the economic crisis in dif- 
ferent ways. 


The most profitable organised crime activity — organised prostitution and traffick- 
ing in human beings — has contracted due to the economic turmoil in Southern 
Europe (Spain and Greece in particular). This criminal activity still generated the 
largest revenues for Bulgarian criminal networks amounting to nearly €650 mil- 
lion per year. In 2011, the domestic consumption of sex-services recovered from 
the decline in 2009 and 2010. Most revenues from the domestic market are 
generated by foreign visitors to Bulgaria. The continuous increase in the number 
of foreign visitors drives higher the levels of consumption of sex services. The 
internet technologies are increasingly used by criminal networks to offer sex 
services, as well as to recruit and control prostitutes. The internet guarantees 
greater anonymity and hinders control by law enforcement institutions, posing 
serious risks in the future. 


The trafficking and distribution of drugs continue to pose a threat to society. 
Heroin trafficking through Bulgaria registered a decline in the past years due to 
three main factors. First, traffickers increasingly prefer alternative routes over the 
old Balkan route, such as the Turkish-Greek border, or through the former Soviet 
republics. The drop in the volumes of trafficked heroin was also due to the 
problems with the poppy crops in Afghanistan in 2010 and the arrests of key 
actors in the trafficking networks. The twofold drop in domestic sales compared 
to the pre-2007 period is compensated by rising numbers of users who turn to 
available substitutes programs. As a result, the hierarchical structures which con- 
trolled the drug market in Bulgaria until 2008 have been dismantled. In 2011, 
the consumption of other types of psychoactive substances (marijuana, synthetics 
and cocaine) recovered after a sharp drop in 2009 and 2010. The size of the 
domestic drug market in 2011 is estimated at about €180 million. 


VAT fraud related to organized crime is estimated at €350 million for 2010. 
VAT fraud significantly affects the competitiveness of legitimate companies that 


Serious and Organised Crime Threat Assessment 7 


pay their taxes. Such VAT fraud schemes are characterised by a high degree of 
complexity involving multiple companies and actors. The participants in fraud 
schemes have high social status and potential for influence over society, since 
many also operate in the legal economy. After a peak in 2008, the size of VAT 
fraud dropped by 30%, which can be explained by the impact of the eco- 
nomic crisis, but also by the intensified pressure by the NRA, the Ministry of 
Interior and SANS. However, the levels of losses incurred remain high and reach 
10-11% of the VAT revenues. A good indication for the scale of this problem is 
the fact that, according to the NRA, nearly 20% (or about 30,000) of all active 
VAT-registered companies in the country are involved in different forms of VAT 
fraud. Bulgaria’s EU accession was followed by a significant growth in interna- 
tional fraud schemes (e.g. missing trader intra community or “carousel” fraud). 
The international VAT fraud grew almost twofold — from 8% of all losses caused 
by VAT fraud in 2006 to 19% in 2009. 


During the economic crisis the trade in illegal cigarettes became one of the 
fastest growing organised criminal activities. Within two years the size of the 
market tripled and in 2010 reached €250 million or 30%-40% of all tobacco 
products. The main threat stemming from this development is that organised 
crime established resilient and mutually beneficial relationships with transna- 
tional criminal networks, which provide continuous input of illegal cigarettes 
towards the EU countries. At the same time, the mass scale of everyday con- 
sumption of tobacco products created a significant (for the size of the country) 
illegal sector with 400-500 thousand consumers of illegal cigarettes and more 
than 15 thousand participants in criminal distribution networks. Although in 2011 
the sales of illegal cigarettes dropped by 20%, this criminal market continues to 
pose a serious risk for the state budget. Excise duties and VAT revenues from 
tobacco products provide for 10% of all budget revenues, while in many EU 
countries this share is around 1.4%. 


The size of the market for illegal oil products controlled by organised crime 
is comparable to the size of the illegal cigarettes market. The current assessment 
shows that the illegal diesel fuel accounts for nearly 95% of the illegal market 
for oil products. In 2007 - 2009 between 33% and 39% of the diesel fuel was 
sold without payment of excise duties and VAT. The losses to the state budget 
incurred through these sales in 2011 can be estimated at €300 million in unpaid 
excises and €240 million in unpaid VAT. The illegal sales of diesel fuel generate 
between €280 million and €430 million in revenues per year. About 50% of 
these run through criminal networks, some of which include both legitimate fuel 
distributors and criminal entrepreneurs. As many end users of oil products are 
big construction or transportation companies, this leads to unfair competition in 
these economic sectors. 


The present Serious and Organised Crime Threat Assessment also examines a number 
of criminal activities that represent lower degree of threat: counterfeiting of pay- 
ment means and bank-card fraud, loan sharking and extortion racketeering, and 
vehicle theft. 


An intersection point of all these criminal activities is the use of corruption, as 
well as the laundering of proceeds of crime. Organised crime in Bulgaria con- 
tinues to use corruption as an instrument to facilitate criminal activities and to 
evade criminal prosecution. There is strong evidence that over the past several 
years corruption related to drugs and prostitution markets has substantially 
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declined. The illicit cigarettes trade and VAT fraud generate significant corruption 
within law enforcement, state and local administration, and local level political 
parties. 


The revenues from criminal activity remain high despite the worsened eco- 
nomic conditions. The greater part of the criminal networks in Bulgaria also 
operates legal business structures, which facilitates the legalisation of criminal 
proceeds. The level of penetration of organised crime into the legal economy 
is significantly higher than the levels in Western Europe. 


The current analysis outlines a number of new threats. One of these is the 
emergence of large resilient criminal networks for illegal distribution of 
tobacco products, which have the potential to establish a criminal infrastructure 
to be used by other forms of organised crime. Another category of threats is 
associated with the use of new technologies in offering sex services, bank card 
fraud, vehicle theft, etc. As a result of increasing migration flows globally and 
the difficult situation at the Greek-Turkish land border in 2011, Bulgaria’s entry 
into the Schengen area may lead to higher pressure from secondary illegal migra- 
tion at the Bulgarian Greek border. Last but not least, there is a risk of new 
forms of trans-border tax and customs fraud stemming from the increased socio- 
economic tensions in Greece. 


FOREWORD 


Following the adoption of the National Security Strategy and the Integrated Strategy 
for Preventing and Countering Corruption and Organised Crime, the Bulgarian govern- 
ment developed a detailed Action Plan for Preventing and Countering Organised Crime 
which tasks the respective government institutions with submitting a Serious and 
Organised Crime Threat Assessment (SOCTA). This assessment should inform the 
design of policies and specific operational plans for countering organised crime. 
It is an important part of a European-wide cycle of policy development in this 
area. 


The Hague Programme for Strengthening Freedom Security and Justice in the European 
Union’ defined the combat and prevention of organised crime as a priority in 
the framework of the Community policies. Both the Implementation Plan of the 
Programme? and the Commission Communication to the Council and the 
European Parliament of 2 June 2005? set the task of developing a strategic con- 
cept for countering organised crime based on prevention, on a proactive infor- 
mation and intelligence data gathering and on cooperation between law enforce- 
ment and the judiciary, third countries and organisations. These steps started the 
process of developing the European Organised Crime Threat Assessment 
(OCTA). 


The conclusions of the Hague Programme called for Europol’s OCTA to become 
a key element of the proactive European model of fighting crime (European 
Crime Intelligence Model). This was followed by the launch of the Harmony 
Project* by the Belgian Presidency of the EU in 2009. It has aimed at integrat- 
ing the EU instruments already in existence (including the OCTA) within a more 
consistent and effective approach. In line with the Harmony Project a decision 
was adopted to introduce a new policy cycle in an effort to counter serious 
and transnational organised crime for the period 2013 - 2017. This cycle and 
the future concrete operational plans will benefit from the new edition of the 
Serious and Organised Crime Threat Assessment (SOCTA).° 





' Council of the European Union, Brussels European Council, Presidency Conclusions: Annex 
1 - The Hague Programme for Strengthening Freedom, Security and Justice in the European Union, 
Brussels, 4/5 November 2004. 

2 European Union, Council and Commission Action Plan implementing the Hague Programme on strength- 
ening freedom, security and justice in the European Union, Official Journal of the European Union 
(C 198/1) on 12 August 2005. 

3 Commission Communication to the Council and the European Parliament of 2 June 2005: 
“Developing a strategic concept on tackling organised crime” [COM(2005) 232]. 

4 European Council conclusions on the creation and implementation of an EU policy cycle for 
organised and serious international crime, 3043rd Justice and Home Affairs Council meeting, 
Brussels, 8 and 9 November 2010. 

> Council of the EU (2010), Council conclusions on the creation and implementation of a EU policy 
cycle for organised and serious international crime, 3043rd Justice and Home Affairs Council meet- 
ing Brussels, 8 and 9 November 2010. 
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The Bulgarian SOCTA assesses the 
current threat of organised crime 
and estimates future risks. It draws 
a map of the threats for the coun- 


try stemming from key crime 
Threat ’ areas and ranks them according to 
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optimal distribution of financial 
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The process of developing the Bulgarian SOCTA 








What makes the present assessment different from past ones (for example the 
Ministry of Interior contribution to the Europol’s OCTA) is the process of its 
development and the methodology used. Following the best European practices, 
the present assessment for the first time represented the outcome of cooperation 
between all relevant law enforcement agencies, as well as well as a_private- 
public partnership. The assessment was developed through information and col- 
laboration provided by representatives from the General Directorate Combating 
Organised Crime (GDCOC), General Directorate Criminal Police (GDCP), the 
Customs Agency, the National Revenue Agency (NRA), and the Center for the 
Study of Democracy. 


Numerous interviews were also carried out with intelligence officers and police 
investigators from the GDCOC and the GDCP, as well as prosecutors and rep- 
resentatives from the NRA, the Customs Agency and the private sector. Additional 
interviews were also conducted with representatives of NGOs and with some 
offenders. The report also benefited from different research papers and used 
statistical data from the National Crime Survey (NCS). 


In the process of elaborating the Bulgarian SOCTA expert advice was sought from 
representatives of several law enforcements institutions within the EU: the UK 
Serious and Organised Crime Agency (SOCA), the National Police in the 
Netherlands (Korps landelijke politiediensten), the Belgian Federal Police (Police 
judiciaire federale), the Criminal Police of North-Rhine Westphalia (Landeskriminalamt 
Nordrhein-Westfalen), the Sweden Customs Office, Europol and the UN Office 
on Drugs and Crime (UNODC). 
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Scope of the assessment 


Report structure 


Assessing the threat from organised crime requires a clear definition of the scope 
of the terms ‘serious’ and ‘organised’ as descriptions of crime in Bulgaria. The 
concepts used in such an analysis should be clearly distinguished from popular 
clichés or political rhetoric — such as ‘mafia’ — mostly influenced by Bulgarian 
and foreign media. The report also avoids traditional criminological definitions 
of ‘organised crime’ that are based on long lists of descriptive characteristics. 


The analytical scope was widened to base the assessment on terms such as 
illegal markets or illegal activities. This approach permitted to identify not only 
the threats emanating from particular criminal groups and persons, but from a 
broader array of legitimate or grey economy actors who may be involved in the 
provision of illicit goods and services or contribute to the commission of an 
illegal activity. This allows policy makers to consider not only law enforcement 
measures but also other policy options for countering organised crime. 


The definition of ‘organised crime’ adopted in this report also takes into account 
the slightly different meaning that this term implies in Bulgaria, in comparison 
to much of Western Europe or the US. The transition from centralised to a 
market economy and from one party system to a democracy created an envi- 
ronment linking criminal networks and legitimate companies in a symbiosis 
between typical organised crime activities (drugs, prostitution, contraband) and 
white-collar crime (tax, privatisation, public procurement fraud, political corrup- 
tion). Therefore, serious fraud is an integral part of the present assessment. 


One aspect of the assessment that requires a caveat is the impact of counter- 
organised crime policies and actions. There are certain radical changes in such 
policies and actions that may impact and significantly reduce the threat from 
organised crime. In the presentation of some of the data this assessment takes 
a historic perspective. In such instances the significant changes in counter- 
organised crime policies may explain the shifts in the level of the threat from 
organised crime. The analysis only notes the impact of such radical policy shifts 
and does not assess the ongoing regular counter-organised crime policies. 


The Bulgarian threat assessment was developed in several phases. The first phase 
consisted of a preliminary and broad research of crime data which fall within 
the serious and organised crime categories. In the second phase, an analysis was 
carried out to determine which key criminal activities or illegal markets posed 
the greatest threat. The last phase was dedicated to additional in-depth analyses 
of intelligence data and open source materials (statistical, market, criminological 
research). 


Eight key illegal markets and activities were identified as causing the greatest 
harm to the economy and society. The first group of threats encompasses tradi- 
tional organised crime activities (human trafficking and prostitution, drug-related 
crimes). The second group of threats is related to crimes against the tax system 
(excise and value-added tax frauds) and the illegal cigarettes trade. Two other 
areas — loan-sharking and counterfeiting of payment means were analysed with 
regard to the harm they inflict on the democratic process and the country’s 
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image. These are followed by motor vehicles theft. Finally, the report presents 
one horizontal issue, which represents the meeting point of all the criminal 
activities, namely money laundering. 


There are a number of organised criminal activities and illegal markets that 
remained outside the assessment: trafficking of cultural goods, environmental 
crime, telephone fraud,° some forms of economic crime, etc. They have been 
excluded for two reasons: either the preliminary analysis showed that the harm 
from them is not significant; or that the available data and analytical methods 
did not allow for a sufficiently robust assessment of the threats and harm. 





6 This is a widespread type of fraud where victims (usually elderly citizens) are contacted by 
phone and are defrauded into giving large sums of money on the pretext that their family 
members have been in a road accident and money needs to be immediately paid to defence 
lawyers or police. The 2011 National Crime Survey showed that 25% of the population have 
received such fraudulent calls. 
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THE DYNAMICS AND CHARACTERISTICS OF ORGANISED CRIME 


FIGURE 2. 


respondents with access to drugs 


The period reviewed in the present report — 2010 and 2011 —- was highly 
dynamic due to a number of socio-economic and political factors. Bulgaria’s 
accession to the EU in 2007 opened a wide range of new opportunities for 
criminals, such as tax crimes, which prompted part of the criminal networks to 
shift their focus towards these new illegal activities. At the same time, 2009 was 
the beginning of the economic crisis in Bulgaria and a period of growing unem- 
ployment which continued throughout 2010 and 2011. Therefore, in 2009 — 2010 
registered crime and crime victim surveys showed for the first time in ten years 
an increase. The recovery of the Bulgarian and the European economies led to 
a drop in crime rates in 2011. 


At the same time, some illegal markets followed different trends. The figures 
below provide data on two key criminal markets, drugs and sex services, which 
allows for an assessment of the impact of the economic crisis. 


The figures indicate that in 2011 the drugs market recovered from the sharp 
decline in 2009 and 2010, and returned to the pre-crisis levels of 2008. The 
trend in the sex services market is similar, where in 2011 the number of serv- 
ices used even slightly exceeds the 2008 levels. 
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In 2009 and 2010, there were indications of a decreasing trend in other crimi- 
nal markets. Vehicle theft, illegal alcohol trade and VAT fraud also decreased. An 
exception to this tendency was the sale of illegal cigarettes, where the market 
started to grow in 2009 and reached a peak in 2010, followed by a subsequent 
decline. The market for illegal financial services (loan sharking) also registered a 
continuous growth over the past few years. 


The size of the illegal markets in the country defines the potential (or the 
limitations) of Bulgarian organised crime. The 12 most significant organised 
criminal activities generated around €1.8 billion in annual turnover (see Figure 
4), which is equivalent to 4.7% of the country’s GDP. Such levels pose a seri- 
ous threat to the country’s development. 


FiGuRE 4. TURNOVER OF ILLEGAL MARKETS IN BULGARIA? 
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7 This is only an illustration aiming to provide a general idea about relative revenues. Throughout 
the report estimates and ranges are provided and explained in more detail. 
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The assessment of the size of illegal goods and services controlled by organised 
crime allows for an estimate of the number of organised criminals involved. The 
persons involved in organised crime networks in 2010 — 2011 ranged between 
4,000 and 5,000. The sectors with the most participants were the sex services 
and trafficking in persons (1,500 - 1,800 involved), the cigarettes market (1,400 — 
1,600 persons dealing in wholesale) and the drugs market (1,000 — 1,200 drug 
dealers at all levels). 


There are a number of other persons gravitating around this core group of 
criminals within each illegal market (especially in the smuggling and sale of 
consumer goods, including cigarettes, illicit alcohol, etc.), who operate within 
the grey economy. They support the functioning of the illegal market by com- 
mitting a wide range of administrative violations usually not classified as crimes. 
In practice, however, without this infrastructure at the lowest level - constituted 
of a large number of socially marginalised individuals — the functioning of 
criminal markets would be impossible. A case in point is the distribution of 
illegal cigarettes, where between 5,000 and 7,000 street vendors of small quan- 
tities can be sanctioned only by an administrative penalty.® 


The existence of this wider group of participants, typical for the lowest levels of 
the criminal markets, often creates the impression that there is no proper 
organisation. This layer is the periphery of organised crime. Some illegal goods 
and services (cigarettes, sex services, cannabis, oil products) are provided by 
participants who work for themselves and are not part of organised crime. They 
take advantage of a criminal ‘ecosystem’ flourishing around the core of powerful 
criminal organisations but manage to evade control over long periods, or pay a 
type of criminal rent in exchange for access to lucrative markets or for protec- 
tion, usually from the competition or from prosecution. Together, these informal 
and illegal economic activities flow into the grey economy which is equivalent 
to 25 — 30% of the country’s GDP, or between €9.7 — 11.7 billion for 2011.° 


1.1. Structure and illegal markets 


The functioning of criminal organisations would be impossible without the 
supporting activities in the grey sector and largely depends on the symbiosis 
and permeability among the criminal, grey and legal economies. The laundering 
of criminal proceeds’? and operation in the legal economy through legitimate 
businesses are typical for any bigger criminal structure. Another modus operandi 
is to maintain a wide network of different intermediaries or offshore entities 
which are used as proxies of the actual ownership of major Bulgarian companies. 
Figure 5 illustrates the share of and the links between the different segments of 
the Bulgarian economy. 


The tobacco market is a case in point. Tobacco companies in the legal market 
create or exploit two different types of distribution networks. The first involves 





8 A similar problem exists in nearly all the EU member-states like Germany, France, UK, Italy 
and other West European states where street cigarettes sellers are immigrants from developing 
countries. 

9 Center for Study of Democracy (2011), Dynamics of the Hidden Economy in Bulgaria and the Global 
Economic Crisis, Sofia: CSD. 

10 Indications of property acquisitions exists in several sectors in the legal economy in Bulgaria, 
but also in a number of other EU member-states. 
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FiGure 5. 


The Dynamics and Characteristics of Organised Crime 


withholding the payment of some VAT through distribution companies which can 
be defined as grey enterprises. The second network is a purely criminal scheme 
involving the sale of established cigarette brands without paying excise and VAT 
through a periphery of criminal companies. This example also shows how crim- 
inal structures from one illegal market are linked to criminal networks from other 
black markets. 
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The intertwining of big corporations and distribution companies from the grey 
and illicit markets is an example of a key threat — the convergence of white 
collar and organised criminals. High level corporate criminals known as ‘oli- 
garchs’ operate not only in Bulgaria but in most of Eastern Europe. Behind their 
legitimate corporate fagade, oligarchs may be directly involved in criminal 
activities (VAT or excisable goods fraud, etc.) and rely heavily on illicit lobbying 
and corruption in their usual business practices. During the 1990s and the early 
2000s, political corruption facilitated the rise of such economic conglomer- 
ates, initially via rigged privatisation deals, and later continued to exploit pub- 
lic resources through rigged public procurement tenders. Unlike Western Europe 
and the US, in Bulgaria white collar criminals may be directly linked to various 
other forms of organised crime. 
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There are two major threats emerging from this constellation. The first is related 
to the inability of law enforcement and the judiciary to reach the top levels of 
organised crime, as these largely reside in the legal economy and have 
political leverage. As a result, whenever law enforcement institutions effectively 
crack down on low-level criminal structures these are immediately re-established 
by the structures at the higher levels. The second important threat is related to 
the persistent public and media perception that some big Bulgarian economic 
entities are involved in organised crime. This perception is often exploited by 
political parties who tacitly favour some and publicly denounce other oligarchs 
thus seeking populist effects. 


1.2. Corruption and violence 


Apart from the financial dimension of criminal markets, the level of violence is 
another critical aspect in the assessment of the actual threats from organised 
crime in the country. The violence used by the so-called ‘violent entrepreneurs’ 
during the 1990s and the large number of murders of individuals associated with 
organised crime between 2000 and 2007 had a strong impact on the political 
process in the country, as well as on the European Commission’s evaluation of 
the fight against organised crime in Bulgaria (see Figure 6). 


Decline in violence is usually indicative of attempts by organised crime to regu- 
late illegal markets and settle accounts through other means. Over the last 
decade, organised crime in Bulgaria has undergone a transformation. The conver- 
sion of criminal capital into legitimate business structures led to greater demand 
and potential of corruption as an instrument. On the one hand, corruption is a 
tool that can be used to regulate criminal markets through corrupting law 
enforcement. On the other hand, corruption is used to settle business conflicts 
(through leverage in the judiciary) and to take control of additional economic 
resources (through manipulation of public procurement). 


Unlike petty corruption which is measured by various survey methods, there are 
no widely used methods to measure corruption used by organised crime. The 
corruption mechanisms and schemes used by organised crime in Bulgaria are 
not very different from those identified in other European countries.’ EU mem- 
ber states register varying levels of this type of corruption. In Spain, for example, 
it was identified that 17% of crime groups use corruption as a tool to exert 
influence’. In Belgium, 23% of crime groups are likely to use some form of 
influence, with the private sector, police and customs named as most affected.” 
Analysis of a sample of 104 criminal groups unveiled that information about 





" Center for the Study of Democracy (2010) ‘Examining the links between organised crime and 
corruption’. This study, carried out by CSD on behalf of the European Commission examines 
how organised crime uses corruption in EU-27. One of the seven country studies included in 
the report is on corruption and organised crime in Bulgaria. 

2 Spain: Ministry of Interior (2010) Situacion 2009 — Crimen Organizado en Espana 

8 Service de la Politique Criminelle, Rapport annuel 2007 sur la criminalité organisée en Belgique 
(2005 — 2006). 
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corruption use existed about 45% of the groups. However, these findings do 
not allow outlining any tendencies'* or making international comparisons". 


FIGURE 6. ORGANISED CRIME AND VIOLENCE DURING THE DEMO- 
CRATIC TRANSITION (1989 — 2011) 
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The analysis identified different tendencies over the past years in the use of 
corruption within the criminal activities reviewed in the current report. In the 
drugs market corrupt influence has abated in recent years due to the dismantle- 
ment of hierarchical structures and control over particular territories. In previous 
years, the territorial zoning of the drug market in some parts of the country was 
associated with corruption in the police structures.'¢ 





4 Unlike corruption affecting businesses and households, which is measured with diferent 
sociological methods, there are no widely accepted instruments for measuring the corrupt 
influence exerted by organised crime. 

5 Law enforcement institutions in countries from the EU have adopted different definitions of 
the term “corruption”. 

© Center for the Study of Democracy (2007): “Organised crime in Bulgaria — markets and 
trends”, p. 39. 
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Similarly, the increased use of the Internet in the sex services market limited 
the contact of criminals with police officers, as well as the corruption pressure 
that criminals exert on them. The rise in illegal cigarettes sales, on the other 
hand, indicates one area where organised crime resorts often to corruption. 


The most serious political corruption concerns political parties at the local level. 
In some municipalities organised crime leaders have either established their own 
political parties, or managed to become members of local municipal councils. 
These political posts are then used to trade in influence or to exert influence 
over local law-enforcement or judiciary, as well as to rig public tenders. 


The oligarchs present a particular threat, as they have undue influence over local 
authorities, as well as some Members of Parliament. The main factor is the oli- 
garchs’ local political and economic influence, as well as the illegal practices 
which dominate some sectors of the economy (timber and metal scrap trade, 
excisable goods trade, and energy). One especially detrimental practice is the 
buying of electoral votes. Waste-disposal industry oligarchs, in particular, (who 
are the largest employer of members of the Roma minority) use their influence 
to manipulate the electoral voting of many Roma communities. 


ys 
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PROSTITUTION AND TRAFFICKING IN PERSONS 


Trends 


Organised prostitution and _ trafficking in persons represent possibly the most 
significant source of income for organised crime in Bulgaria. Trafficking is further 
related to four main criminal activities: sexual exploitation, labour exploitation, 
mendicity and pick-pocketing, and selling of newborn babies. Human trafficking 
for sexual exploitation is the most socially damaging but also the most lucrative. 
On the other hand, both the exploitation of children for forced begging and the 
smuggling of newborn babies have a long-term adverse social effect and cause 
widely shared public concern. Compared to the trafficking for sexual exploitation, 
however, they represent a far lesser threat in terms of scale and potential of the 
organised crime groups involved. 


One reason for this is that human trafficking for sexual exploitation is closely 
related to organised prostitution inside the country. Despite the recently observed 
fragmentation of the prostitution market, some of the criminal groups which 
control organised prostitution are also involved in human trafficking. For the past 
several years, the sex services sector in Bulgaria has become better established 
and public tolerance of prostitution has increased. Over 20% of the Bulgarian 
citizens consider paying for sex an acceptable practice and over 36% of them 
support the legalisation of prostitution.”” 


During the period 2010 -— 2011 several trends have emerged: 


¢ Diversification of provision: under the growing pressure on organised crime 
from law enforcement starting back in 2007 the tightly controlled domestic 
prostitution market started to fragment. As a result, small groups of pimps 
and prostitutes are less prone to be integrated in bigger and _ hierarchically 
structured criminal groups, preferring instead to form informal networks oper- 
ating according to market rules. 


¢ The economic downturn reduced the demand for paid sex and the revenues 
of organised crime. In 2009, the revenues from the domestic market decreased 
by 50 — 70% compared to previous years.'8 In addition, the crisis in neigh- 
bouring Greece also resulted in a smaller number of clients in the border 
regions. 





7 According to data from the National Crime Survey (2011). 
8 National Crime Survey data. 
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e Since 2010, shrinking demand and pressure from law enforcement authorities 
specifically directed at the clubs for sex services has led to the closure of 
many of these previously busy establishments. 


¢ Organised crime undertook two distinctive strategies aimed at compensating 
for lost revenues: 


® Expanding human trafficking and prostitution in foreign countries; 


© Increasing the use of internet (through dating sites, use of social networks 
and chatting services) for attracting clients and recruiting girls into prostitu- 
tion, establishing more call-girl services, etc. 


As a result of the joint efforts of the law enforcement authorities of Bulgaria, 
France, Belgium, and the Netherlands, the Bulgarian prostitution trafficking has 
redirected its attention towards Germany!’. In addition, the fall in demand for 
sex services in some West European countries pushed a good part of the crim- 
inal networks to turn to other, more lucrative markets or to Bulgaria. 


The domestic market for sex services is much smaller compared to the market 
for organised prostitution abroad. The registered cases of victims of human traf- 
ficking in the European countries are indicative for the extent of the problem.”° 
Bulgaria appears to be the leading source country for victims of trafficking in 
Germany and Greece and the second most important for Netherlands when 
taking into account number of cases per capita for 2009. 


A good starting point for assessing the value of the sex services sold abroad are 
the registered cases of cross-border traffic of women for sexual exploitation. 
Based on these, it can be estimated that between 11,000 and 21,000 Bulgarian 
prostitutes are exploited abroad.?' If an average of 18,000 is considered, and 
given that a single prostitute generates about €300 daily with around 270 work- 
ing days annually, the overall revenues amount to €1.46 billion per year. Only 
part of the money, though, remains within Bulgarian criminal groups, and even 
smaller part is returned to Bulgaria. 


There are two approaches to estimating the revenues from the domestic sex 
trade. One approach uses the number of prostitutes and their average workload 





19 This conclusion is drown upon information from field interviews with pimps and data for 
number of identified victims of human trafficking in Germany (Bundeskriminalamt, Trafficking 
in Human Beings National Situation Report 2010, Berlin 2011). 

20 The trafficking in human beings is defined as recruitment, transportation and subsequent 
exploitation of persons. Previous research and expert assessments on the share of involuntary 
prostitution abroad (i.e. related to some form of exploitation) amounts for 5-10% of Bulgarian 
sex workers abroad. 

21 Data on registered cases of human trafficking originating from Bulgaria (1015 victims) is based 
on review of the published reports of the National Rapporteurs on Human Trafficking in the 
Members States of the EU for the period 2005-2009. For further details on the methodology 
applied for these estimations, please refer to: Centre for the Study of Democracy (2007), 
Organised Crime in Bulgaria: Markets and Trends, p. 123-125. 
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and income. The number of sex workers is estimated to be between 6,000 and 
10,000; 33% of them are engaged in street prostitution, 61% — work in-doors 
(offices, clubs, erotic bars, etc.), and 6% — in escort V.I.P. services.22 The estimate 
based on this approach is that the annual revenues may be between €123 mil- 
lion and €205 million per year. 


An alternative approach is based on consumer surveys. In 2010, the share of 
men who admitted the use of sex services was 1.9 — 2.8% of the adult popu- 
lation, or between 61,000 and 88,000 clients.23 This would suggest that the size 
of the domestic market is between €5 million and €9 million. During the past 
few years there has been a steady rise of the number of regular clients (adult 
men who paid for sex in the preceding month) — between 2008 and 2010 their 
numbers doubled.” 


The relatively small number of Bulgarian clients and the large number of pros- 
titutes suggest that most revenues from the domestic market are generated by 
foreign visitors to Bulgaria. They use sex services either during their stay or while 
transiting through Bulgaria. In 2010, at least 380,000 foreign tourists used sex 
services,*> generating at least €13 million in revenues. If short term business 
visitors and the transit truck drivers are added, this number would most likely 
more than double. 


In terms of sex workers per capita, Bulgaria ranks as an average European coun- 
try — 1.46 of every 1,000 persons of the adult population over 15 years. The 
prevalence of sex services’ use among adult men shows that between 3.8 and 
5.9% of the male population in the age-group of the over 15 years of age had 
paid for sex at least once in their lives.2° This is a relatively low percentage 
when compared to other European countries (16.7% — 45% in Italy or 13.5% — 
21.6% in the Netherlands).?7 


2.3. Structure and organisation 


Prostitution in Bulgaria is mainly concentrated at bigger regional centres (Sofia, 
Plovdiv, Varna, Burgas), the bigger winter and summer tourist resorts and in the 
regions along the border with Greece. Three general types of prostitution could 
be distinguished: street prostitution, club prostitution and elite prostitution. The 
criminal networks which control this market in big cities like Sofia and Varna, 
may have as many as 4 or 5 levels in their organisations. Prostitutes are at the 
lowest level and pimps are the second level. At the third level are the criminals 
who collect the rackets (these could be club managers). At the top levels are 





22 Sex Work in Europe. A mapping of the prostitution scene in 25 European countries. Annex 4: National 
Reports, Bulgaria, TAMPEP, 2009: 26-39. 

23 National Crime Survey data. 

24 Ibid. 

25 In 2010, Bulgaria was visited by 8,374,034 foreigners: 50% of them were tourists, while the 
rest were traveling on business or for other purposes. About 86% of the visitors represent the 
age group 18 — 55 and 50% of them were men (data from the National Tourist Agency). A 
study among male tourists at the Black Sea resorts showed that 21.5% of them used sexual 
services, and that most of them used these twice during their stay (39.5%). 

(Prostitutsia i seksualna exploatatsia, Risk Monitor, 2010, p. 46). 

26 Data from the National Crime Survey of the CSD. 

27 ProCon, org. “Percentage of Men (by Country) Who Paid for Sex at Least Once: The Johns 
Chart”. Prostitution.ProCon.org. 
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criminal bosses or their top managers who control the sex club networks. During 
the last two years a number of these bosses in Sofia and Varna came under 
public scrutiny as a result of police operations. The result was a reduction of 
the size of their operations and a larger number of independent sex workers. 
On the other hand, new criminals coming from the lower levels in the hierarchy 
are gradually replacing the old bosses. 


A new challenge is the increased use of internet as a medium to offer sex 
services — between 800 — 1,200 unique sex services offers are posted on web 
sites each month. The risks stem from the greater anonymity and the difficul- 
ties in identifying the women and the criminal networks behind these offers. 
The web is adapted by organised prostitution networks to their usual modus 
operandi: old owners of brothels and erotic bars now publish ads for sex serv- 
ices on their own web-pages or use existing sites that offer escort services or 
place free advertisements. The difference is that prostitutes who offer services 
via the internet, no longer serve clients at brothels but operate more like a 
call-girl service.” 


A tendency towards further fragmentation is also discernible in human trafficking 
for sexual exploitation. In most of the country’s regions the prevailing criminal 
structure is represented by one pimp who controls 2 — 3 girls, though organised 
groups with 10 or more girls exist. In the majority of cases the pimps are not 
residing in the destination country but instead they use the services of the so- 
called ‘first girl’ to collect the proceeds from prostitution. The mechanisms for 
exerting control over the girls include withholding their ID documents, indebted- 
ness, frequent repositioning from place to place, the use of violence (used less 
frequently in the last years) and intimidation, etc. Organised prostitution abroad 
operates through loose networks built on a regional principle, rather than a 
hierarchical structure. The bigger groups specializing in human trafficking are 
mostly ethnicity-based. 


Among the main negative impacts directly or indirectly related to the prostitution 
market and trafficking in persons are the following: 


¢ The Roma community is particularly vulnerable to different forms of traffick- 
ing. Some forms (e.g. trafficking for pick-pocketing or begging and selling of 
newborn babies) are observed only in Roma communities. 


¢ Money laundering. Both the domestic and the markets of sex services abroad 
generate a considerable inflow of money which is laundered into the legal 
economy. This often distorts whole economic sectors in some parts of the 
country and undermines the free competition principle by side-lining the 
companies which abide by the market rules. 


¢ Sexual exploitation often includes exploitation of minors for sexual purposes 
(especially through the domestic trafficking and the street prostitution net- 
works). 





28 Source: analysis of over 90 internet websites with sex services offers (including specialised sites 
for escort services and websites for free advertisements). 
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Outlook 


¢ Public health harm. The rise in demand and the offering of sex services 
in the country and abroad is directly related to an increase in the number 
of cases of such socially significant infectious diseases like syphilis and 
HIV/AIDS. 


Several factors contribute to the steady growth of the domestic market for sex 
services. The most important is the rise of the number of foreign visitors to the 
country. Currently, sex tourism occupies the larger share of the sex services 
market in the country. The increasing number of tourists is expected to further 
push up demand in the next years. 


Internet-based recruiting of young women for paid sex through the use of social 
networks, dating sites and chat software is increasing. The large scale introduc- 
tion of the internet for offering sex services is implying greater anonymity and 
a much more difficult control by law enforcement, which would probably foster 
rapid growth. 


Meanwhile, the continuing economic crisis and high levels of unemployment are 
conducive to higher levels of vulnerability of certain social groups which are the 
potential target of human traffickers. The demographic trends of dwindling num- 
bers of women in the age group between 18 and 26 years, when combined 
with a growing demand for sex services, will inevitably lead to shifting the 
recruitment of girls for prostitutes towards bigger cities, rather than from rural 
regions. In the future, this will be a factor for transforming Bulgaria from a source 
into a destination country for the traffickers of human beings for sexual exploi- 
tation. 


3. 
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TRAFFICKING AND DISTRIBUTION OF ILLICIT DRUGS 


Trends 


Cross-border trafficking and trading in illicit drugs are among the essential 
income sources for organised crime in Bulgaria and pose a high public threat. 
The prevalence of drug use is closely linked to the levels of petty crime, the 
number of road accidents and the prevalence of certain socially significant dis- 
eases (e.g. HIV/AIDS, hepatitis). The illegal distribution of drugs also breeds 
violence more often compared to other organised crime activities. 


Bulgaria is a transit country for drug trafficking and the role of Bulgarian organ- 
ised crime groups is shaped by the geographic location of the country on the 
Balkan route for smuggling heroin from Afghanistan to Western Europe, as well 
as for smuggling synthetic drugs and precursors from Europe towards the Middle 
East. Bulgarian citizens are also involved in transnational organised crime net- 
works which are trafficking cocaine from South America (including through Africa) 
towards Europe. Currently, the participation of Bulgarian citizens in these crimi- 
nal networks is most often at the low and the middle level, but there are 
certain exceptions which pose a real threat for making the country an entrance 
point and transit territory for the cocaine trafficking to Western Europe. 


The Bulgarian market for illicit drugs is relatively small in size compared to most 
drug markets in Western Europe. Nevertheless, it comprises many actors with 
substantial financial potential and influence. During the last 20 years there has 
been a well-established retail market for heroin, and growing markets for syn- 
thetic drugs, cannabis and cocaine. 


Small amounts of cannabis and limited amounts of synthetic drugs (mostly 
amphetamines), are also produced in Bulgaria which by and large meets domes- 
tic demand. 


International drug trafficking 


There was a significant decrease in the heroin trafficking over the past years, 
although heroin remains the illegal drug of choice for smuggling through the 
country. Heroin traffickers increasingly prefer the alternative Silk route over the 
Balkan route. The drop in the volumes of trafficked heroin was also due to the 
problems with the poppy crops in Afghanistan in 2010 and the arrests of key 
actors in the trafficking networks during several successful international law 
enforcement operations. The tightened cross-border control at the Bulgarian- 
Turkish border in the last years has also diverted the trafficking channels through 
the Turkish-Greek border and the Caucasus. 


28 Trafficking and Distribution of Illicit Drugs 


The second most often trafficked illicit drugs through Bulgaria are synthetic drugs, 
mostly amphetamines and ecstasy. In 2010 and 2011 there was a boom in the 
smuggling and distribution of the so called ‘designer drugs’ or ‘legal highs’ 
originating from China or India.2? The introduction of new law amendments in 
the last 2 years for faster criminalization of the identified new synthetic drugs 
is expected to diminish the trafficked and distributed volumes of these sub- 
stances in the country. 


The data on Bulgarian citizens arrested abroad for 2010 — 2011 shows a decreas- 
ing number of arrests in relation to transnational drug trafficking for all kinds of 
drugs. This trend could partially be explained by the shrinking of the drug mar- 
kets in Western Europe due to the economic crisis. 


3.1.2. Distribution of illicit drugs 


The hierarchical structures and the strict territorial zoning which had been char- 
acteristic of the drug market in Bulgaria until 2007 — 2008 have been dismantled 
in the past three years, most apparently at the heroin market. There are sev- 
eral factors which have contributed to these developments. First of all, this is 
the steady dwindling of the heroin use in the last 10 years, which was further 
facilitated by a heroin ‘drought’ on the streets in 2010 and 2011, and led to 
sharp drop in heroin use. This forced most users to turn to available substitutes 
such as methadone. In 2011, the officially registered patients in substitution 
programmes reached 3,279. A substantial share of these methadone patients 
started to sell part of their methadone at the black market and as a result many 
heroin users partially or fully substituted the heroin with methadone. A good 
indicator for this trend is the amount of methadone imported in Bulgaria — 
according to the Ministry of Health the imported methadone has grown from 
38.2 kg in 2007 to 77.5 kg in 2010. The heroin shortage has also led to dete- 
rioration of purity and rise in the retail prices of the drug on the streets. 


In 2009 and 2010, most of the middle and high level players of heroin criminal 
networks were arrested. The combined effect of strong law enforcement pressure 
and the heroin shortage led to turning the drug market back to the fragmented 
state typical for the early 1990s. The key difference from the 1990s is that the 
prevalent consumption in 2011 is not that of heroin, but of amphetamines and 
cannabis. Cocaine consumption is also increasing. 


3.1.3. Production of illicit drugs 


Up to 2007, Bulgaria was among the European countries with a large scale 
production of amphetamines not only intended to meet the demand of the 
domestic market but also trafficked to the Middle East. While the EU still 
remains one of the big producers of illegal synthetic drugs, in Bulgaria there was 
a sharp downturn in the production intended for export.?° Bulgarian criminals 
partially relocated their production facilities close to the Middle East. Yet, small 
scale production of amphetamines and methamphetamines intended mostly to 
meet demand at the domestic market still continues. There is also a decrease 





29 Between 1997 and 2010, the European early warning system on new psychoactive substances 
has identified over 150 new substances which were being monitored. 

30 According to UNODC data in 2010, 80% of the dismantled illicit drug laboratories were in 
the EU (UNODC World Drug Report 2010). 
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in the outdoor cultivation of cannabis in the Southwest of Bulgaria, which is 
partially due to the increase of the in-door and greenhouse cultivation. 


3.2. Scale of the problem 


The Bulgarian heroin market comprises between 10,000 and 12,000 users?! who 
consume around 2 tons of heroin (at 15 — 31% street purity) annually. Taking 
into account that the retail price of the drug is €15 — €30 per gram and 
the figures above, the value of the market can be estimated to be €14 - 
€28 million. 


The cannabis market is one of the most rapidly expanding in the last 5 years, 
especially among 15 — 34 year olds. From 2007 to 2008, the share of young 
adults who have used cannabis in the preceding 30 days has doubled. According 
to European Monitoring Centre on Drugs and Drug Addictions (EMCDDA) data, 
regular cannabis users in Bulgaria number 55,000 — 88,000 and recreational users 
amount to another 51,000 — 83,000. The overall consumption of cannabis could 
be estimated at 6.6 — 14.7 tons annually; taking into account that the retail 
price is €6.3 per gram, the value of the market could be expected to be 
€41.4 - €92.6 mln. 


The other growing drug market in Bulgaria is the cocaine market. According to 
EMCDDA data, the share of the young adults (15 — 34 years old) who have 
used cocaine in the preceding 30 days has doubled from 0.4% to 0.8%. The 
estimates show that regular cocaine users in Bulgaria (using it 4 or more times 
per month) are 4,000 - 8,000, while the recreational users are 20,000 — 40,000.33 
The overall consumption of cocaine in Bulgaria could be estimated at 300 kg 
with street purity annually. With a street price of €70 per gram, the annual 
value of the market could be estimated at €22.3 — €80.3 million. 


The synthetic drugs market (amphetamines and methamphetamines) has also 
expanded in the last 4 — 5 years. For the period 2005 — 2008, EMCDDA data 
show that the share of young adults (15 — 34 years old) who have used amphet- 
amines in the preceding 30 days has almost tripled from 0.4% up to 1.1%. 
The estimates show that the group of synthetic drugs users is around 46,000 
people and the annual consumption amounts to 2.2 — 5.6 tons. Considering that 
the average street price is €14 per gram, the value of the market could be 
estimated at €31.3 -— €78.8 million.%4 





31 This estimate takes into account the increased number of users in substitution programmes. 

*% The data for average street prices, purity, etc., used in this report has been taken from the 
Statistical Bulletins of the European Monitoring Centre for Drugs and Drug Addictions 
(EMCDDA). 

33 The estimate is based on consumption data by EMCDDA and the RAND methodology (Kilmer, 
B. & R. Liccardo Pacula (2009) — Estimating the size of the global drug market. A demand-side 
approach. RAND). 

+4 The assessment is based on consumption data from the National Crime Survey. It builds upon 
the methodology developed by RAND. 
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For a long period, the drug market in Bulgaria had been structured and divided 
among hierarchically organised crime groups following the principles of territo- 
rial zoning and product segmentation. These hierarchically organised crime 
groups within every territory were structured in a way that each level of the 
organisation was rendering part of their profit to the level above. Different drugs 
were served by independent distribution networks; for instance, heroin dealers 
were not allowed to trade in cocaine or cannabis. 


In the period 2008 — 2009, due to arrests of actors from all levels of produc- 
tion, trafficking and distribution, and the shrinking of the heroin market, the 
existing criminal structures started to disappear and the markets became frag- 
mented. As a result, the organisation of drug trafficking and distribution became 
populated (much like in other EU countries) by many independent actors and 
small groups vying for control of certain neighbourhoods. The cocaine and syn- 
thetic drugs markets are centred on night clubs in cities. These markets are 
structured around loose crime networks, within which criminals provide different 
services — e.g. production (cannabis, amphetamines), trafficking (cocaine, heroin) 
or distribution. The distribution of cannabis is also very often undertaken by 
independent small producers or long-time users within their own informal net- 
works. 


The heroin market has particularly adverse effects on Bulgarian society. The main 
harm associated with heroin use is increased level of crime, particularly domes- 
tic violence, vandalism, petty theft, assaults, burglary, etc. The economic crisis 
and increased unemployment affect significantly the group of problem drug users 
and further worsen the situation.The recent fragmentation of the drug markets 
and the attempts of various new players to take over new territories would most 
probably lead to increased use of violence. 


In addition, drug use adversely affects public health. The injecting drug use is 
directly linked to the transmission of a number of blood borne infections like 
HIV, hepatitis B and C. According to the Ministry of Health by 2011 in Bulgaria 
there were 1,438 HIV positive persons, 21% of whom were injecting drug users; 
in the last years, over 1/3 of all new registered HIV cases are among this group. 
The data of the National Centre for Addictions shows that over 60% of inject- 
ing drug users are infected with hepatitis C. The use of synthetic drugs and 
cocaine is also related to the number of the road accidents in the country. 


The recruitment of drug mules for the transnational cocaine trafficking networks 
among the vulnerable groups of the population is also an issue of concern. 


The overall decrease of heroin use among the population is accompanied by 
its growing use among marginalized groups, especially the Roma. This trend 
will most likely lead to a peak in the petty crime committed by members of 
these communities, as well as a steady increase of the blood borne infections 
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among them. The increase of the infectious diseases within these communities 
will be further aggravated by the overall low education status and the poor 
access to healthcare. 


The latest UNODC reports show 7% increase in lands with poppy crops in 
Afghanistan in 2011 compared to 2010 and 61% increase in the opium produced. 
This new yield is expected to lead to more heroin with better quality on the 
streets in 2012, and become a catalyst of the processes described so far. 


The steady increase of users and respectively the demand on the street for 
cannabis, synthetic drugs and cocaine is expected to raise the production of 
cannabis and amphetamines within the country as well as the trafficking of 
cocaine, hashish and designer drugs towards Bulgaria. In the eastern part of 
Bulgaria there is a trend towards higher spread of methamphetamine use, 
which is replacing the amphetamines. This is an indicator that the metham- 
phetamine production technology is becoming more widespread. The risk of 
addiction to methamphetamine is high and a rise in demand is likely to be 
observed in the next years. 


Several factors are expected to affect drug trafficking in the short term as well. 
The good yield of the poppy crops in 2011 is expected to increase the volume 
of drugs smuggled through Bulgaria in the period 2012 -— 2013. The rising 
demand for cocaine and synthetic drugs will also lead to growth of the cocaine 
traffic and the traffic of precursors for amphetamine and methamphetamine. The 
new role of Afghanistan as a world leading hashish producer might also lead to 
an increase of the hashish trafficked through the country via the traditional 
Balkan heroin route, accompanied by a spill over effect with higher supply of 
hashish on the domestic market. 


The in-door production of cannabis will continue to grow due to lack of control 
of the growing and selling of cannabis seeds in Netherlands; the lack of incrim- 
ination for possession of cannabis seeds in Bulgaria. Moreover the in-door cul- 
tivation allows more yields (3 — 4 yields per year) than outdoor cultivation. An 
important emerging threat is also the use of internet for illegal trade and distri- 
bution of cannabis seeds and designer drugs. 


4. 


4.1. 


VAT FRAUD 


Value added tax (VAT) fraud schemes are a major source of revenues for organ- 
ised crime. EU estimates of the losses from unpaid VAT are in the range of €60 
to €100 billion per year.35 As a result, member states lose between 11% and 
13% from the liable VAT contributions.%° The threat from VAT fraud is of signifi- 
cance as VAT contributions account for approximately 20% of the state budget 
revenues in the EU Member States.°7 


VAT fraud can be divided into two broad categories: unorganised and organised 
VAT fraud schemes.?® The organised VAT fraud is characterized by a_ higher 
degree of sophistication. It is considered a form of organised crime since it 
involves organised abuse of tax credit through fraudulent networks based on fake 
transactions and traders. These schemes include two or more companies which 
reduce their VAT liabilities, evade VAT taxation, or seek improper refunding of 
VAT. Unorganised VAT fraud schemes include attempts by companies to reduce 
or evade VAT liabilities by recording lower sales in the books, or failing to record 
net revenues from real transactions. In many cases the companies using such 
schemes are part of the grey economy. 


Bulgaria’s EU accession in 2007 created new opportunities for organised VAT 
fraud. The fraud schemes specific for Bulgaria (i.e. the X-type schemes, fraud 
related to so-called VAT accounts) were replaced by new criminal opportunities, 
such as the VAT carousel fraud, connected to the intra community trade. The 
threat from criminal networks and organised criminal groups involved in VAT 
fraud lies in their potential to influence political and economic processes. The 
criminal networks involved in VAT fraud usually include accountants and lawyers 
with the necessary qualifications, experience, social status and opportunities to 
influence public officials. 


Scale of the problem and trends 


For the past ten years the losses to the state budget from organised VAT fraud 
amount to at least €2.56 billion.3? Similar to other EU member states, in Bulgaria 





35 European Parliament, Committee on Economic and Monetary Affairs: Draft report on coordi- 
nated strategy to improve the fight against fiscal fraud, 16 April 2008. 

36 Center for the Study of Democracy (2010), Organised crime threat assessment. Methodological 
problems and international experience, Sofia:CSD. 

7 Ibid. 

38 Most tax administrations define organised tax fraud as a mechanism for improper deduction 
or refund by one company of tax that has been unlawfully charged and unpaid by another 
company. 

39 This estimate, along with other assessments cited in this section of the report related to the 
size, trends and sectoral specifics of VAT fraud are based on the tax gap analysis of the National 
Revenue Agency from 2011. 
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the overall VAT gap is much wider than the gap caused by organised VAT fraud.4° 
In the UK for instance, while the total VAT gap for 2009 — 2010 is £11.4 billion, 
the losses incurred by missing trader intra community fraud (MTIC) are about 
£1.8 billion (or 2.2% of collected VAT).*' 


Against this background, Bulgaria’s organised tax fraud is much higher taken as 
a percentage of collected VAT (11.1% for 2010; Table 4). Organised VAT fraud 
reached its highest levels in 2008 and 2009. The levels of organised fraud 
decreased after 2009, but remained above the levels registered prior to Bulgaria’s 
EU accession. The decline registered in the past three years is explained by 
economic slowdown in the country, but also by intensified law enforcement 
efforts to tackle tax fraud. 


TABLE 4. ORGANISED VAT FRAUD GAP AND VAT REVENUES 
(2005 — 2009) 


VAT revenues (€ billion) 3.27 


Organised VAT fraud gap (€ million) 246 244 349 504 413 358 
(forecast) 


Fraud gap / total VAT revenues 10% 8.2% 10.3% 13% 12.6% 11.1% 





Source: NRA, Tax gap analysis 2011 


The following trends were identified for the period 2005 — 2010: 


e¢ The number of high risk companies involved in VAT fraud decreased. This 
indicates a certain consolidation of criminal businesses, as the size of the 
fraud remained at relatively high levels. However, the companies involved in 
VAT fraud (including buffer and shell companies) are 20% (approx. 30,000) 
of all active VAT-registered companies. As one fraud scheme may involve 
several dozen companies, the number of individual criminals controlling these 
companies is significantly smaller. 


e The losses incurred by MTIC increased significantly after Bulgaria’s accession 
to the EU. While in 2006 such schemes generated 8% of the organised VAT 
fraud gap, their sized doubled after 2007 to 19% of the gap (Table 5). 





40 This figure is not public. 
“1 HMRC: “Measuring tax gaps 2011. An official statistics release’, 21 September 2011. 
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TABLE 5. ORGANISED VAT FRAUD GAP: SHARE OF FRAUDS BY TYPE 
OF DELIVERY (IN % OF THE TOTAL VAT GAP) 


Deliveries in the country 88.9% 92.3% 83.6% 79.8% 81.1% 


International transactions (total) Hl % Tl Ye 16.1% 20.2% 18.9% 
Export 2.1% 1.7% 2.3% 0.5% 0.8% 
Intra community deliveries 0.0% 0.0% 2.9% 2.6% 1.6% 
Import 9.0% 6.0% 1.8% 0.9% 0.3% 
Intra community acquisitions 0% 0% 9.1% 16.2% 16.2% 





Source: National Revenue Agency, Tax gap analysis 2011 


4.2. Business sectors at risk 


The risk of unorganised VAT fraud in Bulgaria is higher for wholesale trade in 
oil products? and agricultural production. In the retail trade the goods at high- 
er risk include food products (mainly in small shops), clothes and shoes. The 
VAT schemes often include mid and large size tax payers. 


Three major risk categories can be identified: 


e Approximately 30% of all organised fraud schemes occurred in the construc- 
tion sector (construction and installation services, steel fitting, etc.) 


© 13% of the frauds were related to production and trade in agricultural and 
food products (grain, sugar, meat, grapes, herbs and spices). 


¢ 15% of frauds were registered in the services sector (advertising and other 
services) 


The organised VAT fraud with oil products formed a significantly lower share of 
the total organised VAT fraud —- 2%. 


The economic crisis affected the exposure of certain economic sectors to VAT 
abuses. For example, while until 2008 vehicle trade generated 5.2% of the 
losses from VAT fraud, this percentage declined to 1.23% in 2009 due to the 
collapse of the automotive market. However, there was only an_ insignificant 
decline in the relatively high levels of VAT fraud in the construction business, 
and this sector remains high risk. 





“Trade in petrol products was identified also by Europol as a sector with high exposure to VAT 
fraud in the EU. 
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4.3. VAT fraud schemes 


As outlined above, the unorganised VAT fraud includes a wide range of methods 
for hiding VAT liability. More often than not the lines between unorganised and 
organised fraud are blurred, as the same persons or companies could be 
involved in both types of VAT abuse. 


Unorganised fraud schemes 


The unorganised VAT evasion aims at reducing the tax liability stemming from 
real transactions. This involves concealing taxable receipts coming from the pro- 
duction and sale of real products and services. Sales are not recorded in the 
books, or are recorded at lower than actual values and/or quantities. Alternatively, 
conventional evasion may be effected through overvaluing of input costs and 
claiming larger VAT refunds. 


VAT evasion and non-payment of excise liabilities in Bulgaria most frequently 
occur in the distribution of fuels and oil products. The main mechanisms 
include sales without documents, fictitious purchases, sale of derivatives levied 
with high excise tax rates and sale of petroleum products with low excise duties 
without documents or with falsified documents, fictitious fuel exports, sale of 
marked fuel for heating purposes. 


Organised VAT fraud 


The mechanisms of organised VAT fraud usually involve several companies. 
Besides illegal VAT refunds as a result of underestimation of income or overstate- 
ment of expenses, there are schemes relying on fictitious transactions. The most 
frequent schemes of VAT fraud are the following: 


e Fictitious exports: the exporter carries the transaction on paper, applying the 
zero VAT rate on exports and claiming tax credit on the inputs, while actu- 
ally selling the products on the domestic market without sales invoices, i.e. 
without paying VAT. A safer version would use real exports but would overstate 
the quantities exported, or the exported goods would not correspond in qual- 
ity and type to the declared products. 


e Missing trader fraud: a chain of fictitious transactions in which one of the 
traders (a phantom) takes on all accumulated VAT liabilities and disappears 
without paying them to the state budget, while the rest of the traders in the 
chain have claimed tax credit and received VAT refunds. Another option is to 
transfer the accumulated liabilities to an insolvent trader (often low social 
status person) instead of using a missing trader, as the latter is easier to detect 
before the refund is completed. Legitimate companies often become involved 
in this scheme, willingly or not. 


¢ Carousel fraud: the missing/insolvent trader fraud is implemented through 
repeated rounds of cross border (intra community) transactions. This, on the 
one hand, makes tracking and countering it more difficult and slow, while 
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4.4. 


4.5. 


Harm 


Outlook 


on the other it multiplies the cash return on the missing-trader fraud. The 
magnitude of the problem derives from the lack of customs control over 
goods flows. The carrousel fraud is not widespread in Bulgaria. Most registered 
cases are related to sales of meat products. 


The fraud related to deliveries within the country is characterized by the estab- 
lishment of clusters of companies registered by proxies who accumulate — 
through a number of fictitious transactions — large VAT liabilities payable to real 
companies, thus reducing their contributions to the budget. In most cases the 
transactions are related to construction and installation services at prices 
much higher than the market ones. In some cases the services are not pro- 
vided at all. 


Most registered cases of MTIC fraud involve transactions between Bulgarian 
companies and companies registered in Greece or Romania, as well as shell 
companies based in third countries. The schemes include fictitious import and 
export of high-value goods (mobile phones, computer chips, but recently also 
sugar and fuels) that accumulate large VAT liabilities. 


Besides the obvious harm to the public sector, VAT fraud affects the private sec- 
tor as well, as it creates unfair competition and distorts the market. Companies 
that manage to reduce their tax liabilities through fraud receive competitive 
advantage over regular tax payers. The direct financial losses for bona fide tax- 
payers could also be significant — if they involuntarily become participants in the 
fraudulent schemes they risk being denied tax credit. 


The potential of criminal networks involved in VAT fraud to corrupt is significant 
due to the participation of persons with high social status, as well as legitimate 
companies and oligarchs. They exert corrupt influence over the tax administration 
(to facilitate fraud schemes), the law enforcement institutions, the judiciary as 
well as over political parties in order to evade criminal prosecution. 


The main characteristic of organised VAT fraud — the involvement of numerous 
traders which manage to benefit without their profits being affected — implies 
that unlike other types of illegal activities/markets, there is no direct competition 
between organised criminal groups.*? Furthermore, the trend in the EU is towards 
sharing of knowledge, skills and resources between different organised criminal 
groups and fraud participants at various levels, which enables them to evade law 
enforcement measures. Criminal networks in countries with weaker regulatory 
environments also get involved at the money laundering phase. 


According to the NRA, the current trend in Bulgaria is towards a decline in the 
size of VAT fraud, although the levels of losses incurred are expected to remain 
higher than the average for the past six years. Furthermore, one of the important 
features of VAT fraud is the ability to adapt easily to changing circumstances. 





“Europol: OCTA 2011 
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International carousel fraud may be reproduced in more complex mechanisms 
involving more entities in more countries than previous fraud schemes. Differences 
in tax rates in the EU countries to some extent stimulate the use of this scheme. 
Cooperation and information exchange between countries conducting investiga- 
tions into intra community VAT fraud are not always effective. 


The expansion of digital technology in the storage and distribution of informa- 
tion, the rapid development of internet applications and electronic payment 
services also facilitates the emergence of schemes that can be used to perform 
this type of fraud. 


Ds 


5.1. 


THE ILLEGAL CIGARETTES MARKET 


In 2009 and 2010, the sale of contraband tobacco products (both legally pro- 
duced and counterfeit) became one of the fastest growing organised criminal 
activities. In 2010, the total revenues from the sale of illegal tobacco products 
reached €250 million, or 16 — 18% of total consumption: the legal market 
amounted to €1.24 billion. The size of the illegal market, in terms of cigarettes 
sticks,44 reached between 30% and 40% of all cigarettes sold. 


There are two major criminal threats stemming from this development. The first 
is the mass scale of this illegal activity - within two years the size of the illegal 
market tripled. As such, it became a major source of financing of organised 
crime and impacted other criminal markets. The second threat is related to the 
expansion of the criminal structures involved in this type of illegal activity. In 
2009 — 2010, the customer base grew to over half a million smokers, while the 
number of retail dealers multiplied. Cross-border smuggling and domestic supply 
routes and distribution infrastructure became well established. 


The expansion of the illegal market was mainly caused by the increase in 
cigarette prices*®? which was the result of the alignment of Bulgaria’s minimal 
excise tax levels with EU’s after 2007. Cigarettes in Bulgaria became, in relative 
terms, the most expensive in the EU.*¢ In particular, the sharp increase of the 
price of the lowest class cigarettes fuelled the demand for low-cost cigarettes. 
Growth of the illegal cigarette market was also facilitated by the economic 
crisis and unemployment growth that further increased the demand for illicit 
tobacco products. 


Assessment of the illegal market 


The majority of illegal cigarettes sold in Bulgaria are legally produced — the so 
called ‘illicit whites’’” -— not counterfeit cigarettes. They are either produced 
abroad and then smuggled in Bulgaria, or produced domestically and illegally 





44 The tobacco industry uses as a basic category the number of pieces of cigarettes. Bulk 
tobacco is also measured in this category. Other measurement categories include the cigarette 
pack with 20 cigarettes per pack, the master box which contains 500 cigarette packs or 10,000 
cigarette pieces, the standard container with 10 million pieces or 500,000 packs or 1,000 
master boxes. 

45 Between 2008 and 2010, the prices of midrange cigarettes in Bulgaria increased by 65% - 70%. 
46 This calculation is made by using the affordability ratio which measures the number of mid- 
range priced packs of cigarettes that could be bought on a disposable monthly income. 

47 Illicit whites are of low quality, and although they are legally produced their price is low. 
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distributed, avoiding VAT and excise taxes. ‘Empty pack’ surveys*® indicate that 
the consumption of illicit tobacco in big Bulgarian cities increased from 14% in 
2008 to 34% in 2010.49 In many small towns, border or rural areas the ille- 
gal trade exceeded 50% in 2010. According to estimates based on the empty 
pack method, by the end of 2011 the situation improved as illegal cigarette 
consumption dropped to 19% of the total consumption of tobacco products. 


However, alternative assessments which take into account some drawbacks of 
the empty pack methodology indicate that the consumption of illegal tobacco 
products is higher, and dropped from 40% in 2010 to between 25% and 30% 


FIGURE 7. CONSUMPTION OF LEGAL AND ILLEGAL CIGARETTES 
(2008 - 2011) 
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48 The ‘empty pack’ method is used in the largest study of the illegal cigarette market within the 
EU which is conducted with the support of major cigarette producing companies. The method 
is based on collection and analysis of used empty cigarette packs in randomly selected areas 
in big cities. 

49 This means that in 2008, 14 out of every 100 packs were without excise stamps and paid VAT, 
while in 2010 34 out of 100 were without paid duties. The percentage for 2010 is based on 
data from cities included in the 2007 survey. Counting the towns which were included in the 
additional survey due to the new sharp increase in consumption of illegal cigarettes in small 
towns and border areas, the percentage of illegal cigarette packs is 43.4%. 
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of the total market in 2011 (or between 3.6 billion and 4.6 billion illicit cigarette 
sticks per year).5° 


It should be noted that around 20% of the illegal market is not associated with 
organised crime but is related to the so-called ‘shuttle traders’.°' By the end of 
2011, the illegal cigarette trade associated with organised crime amounted to an 
equivalent of 23 - 25 smuggled containers per month.” 


In addition to the distribution of smuggled cigarettes, certain quantities of legal- 
ly manufactured or imported cigarettes for which importers or local manufactur- 
ers pay excise taxes end up illegally sold in Bulgaria. The scheme _ involves 
mainly retail distributors who (usually by creating shell companies) avoid paying 
VAT on the value-added of retail sales. At least 1 billion cigarette sticks in 2011 
have been subject to this type of fraud.% 


5.2. Structure and organisation of criminal networks 


Monthly sales of nearly 300 million cigarette sticks suggest hundreds of thousands 
of consumers and thousands of participants in the illegal distribution. 


The daily illegal sales are estimated at 500,000 cigarette packs, which indicates 
that the retail distributors involved are between 5,000 and 10,000% selling 
between 5 and 10 cartons (1 carton contains 10 cigarette packs) of cigarettes 
per day.°> If distributors at the mid and high level, shuttle traders, security pro- 
viders, couriers, those working in warehouses and retail storage were to be 





50 These additional assessments take into account the shortcomings of the empty pack method 
which does not cover smaller towns and villages. They take into account the sharp fall in the 
legal market of about 19 billion pieces in 2008 to around 9 billion cigarette pieces in late 
2011. According to retail surveys, the decline in consumption among the population above 15 
years is 17 — 19% for the period 2008 — 2011, as the decline affects both the number of 
smokers and average volumes of consumed cigarettes. This means that the entire cigarette 
market (legal and illegal) should be about 15.5 billion cigarette sticks, or a decrease of about 
30% in terms of cigarette sticks. According to an unpublished assessment of the National 
Revenue Agency, based on analysis of consumer surveys, the size of the illegal cigarettes mar- 
ket is closer to the levels indicated by the empty pack surveys. 

51 The shuttle trade includes contraband of cigarettes through the western border of Bulgaria with 
Serbia and Macedonia, where excise duties are lower, smuggling of duty-free cigarettes pur- 
chased at the Turkish border, as well as small scale contraband from Greece. Although some 
elements of these contraband activities are organised, it can be assumed that there is no 
organised crime involved in this type of trade. 

52 The 2011 seizures of illicit tobacco by the Ministry of Interior and the Customs Agency aver- 
aged 5 containers per month. However it is difficult to estimate the losses of criminal networks 
from these seizures, as part of the seized cigarettes were designated for external markets. 
According to a 2011 report by the Customs Agency, only one fourth of the illegal cigarettes 
seized by the agency are designated for the domestic market. 

53 The starting point of this analysis is the difference between the quantities of cigarettes sold 
according to market surveys among retailers (known as retail surveys) and those for which 
official duties were paid according to the Customs Agency. The difference was about 2.1 billion 
cigarettes in 2011. Further analysis showed that approximately 1 billion pieces are ‘lost’ due 
to VAT fraud, and another 1.1 billion pieces are most likely on the move between distribution 
warehouses and retail outlets. 

54 The estimate includes different types of distributors for which cigarettes are just one of their 
income sources, including those working in small stores, coffee shops, kiosks, taxi drivers in 
mid-sized towns, public and private sector employees who sell to friends and colleagues. 

°° This includes illegal bulk tobacco which is estimated at 5 — 10% of the consumption of ille- 
gal tobacco products. 
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added, the total number of regular participants in the illegal cigarette trade 
would amount to as many as 15,000. 


At the same time, due to legislative loopholes, many participants in the illegal 
cigarettes trade prefer this type of activity due to the lower risk compared to 
other criminal markets, in particular drugs. 


Since 2009, seizures and subsequent investigations have uncovered many differ- 
ent criminal organisations and illegal transactions. Some examples include: major 
legal cigarette manufacturers in the Balkans providing Bulgarian criminal networks 
with access to their brands; large importers involved in international networks 
for distribution of low brand cigarettes (illicit whites); small illegal factories with 
wholesale networks, regional wholesale and retail sale networks, ‘ant smuggling’ 
by small criminal groups who buy and sell cigarettes to retailers. 


The analysis shows that hundreds of stable criminal structures have emerged 
within two years. The typical criminal network functions at one or two levels 
and does not cover the entire range of activities related to importing and dis- 
tribution of illegal cigarettes. They usually focus on a particular phase of the 
process. For instance, large-scale importers and the manufacturers do not control 
the wholesale and retail trade; mid-level networks do not engage in import and 
manufacturing. 


At the highest level of this structure are Bulgarian and Greek entrepreneurs with 
significant financial resources, including 2 — 3 legitimate manufacturers and 5 - 
7 importers. The manufacturers provide part of their production to criminal 
entrepreneurs who avoid paying excise duties and/or VAT on the quantities they 
sell. These entrepreneurs use two main schemes. The most commonly used one 
includes fictitious export and relocation of the products to warehouses for illegal 
distribution. In the second scheme, cigarettes are exported and following a com- 
plex string of transfers of ownership, they are eventually smuggled back into the 
country. 


Large-scale importers work mainly with the so-called ‘Greek hub’5*: a concentra- 
tion of criminal networks in large Greek ports which controls the contraband of 
cigarettes via Greece. The criminal entrepreneurs smuggle illicit whites, manufac- 
tured in the Middle East (mainly in Dubai), Greece, the former Soviet republics 
or even Southeast Asia. The illicit whites are sold by producers legally to import- 
ers. After being resold and reshipped several times, including through duty free 
zones (e.g. Mersin in Turkey), they are smuggled into illegal warehouses in 
Greece, and are then further exported to other EU countries, including 
Bulgaria. 


Another source of illegal cigarettes in Greece are the local illicit production 
facilities which usually produce counterfeits of leading brands. Several factories 
were uncovered in the past few years. The contraband imports are negotiated 





56 The Greek hub has a long tradition in the provision of logistics for contraband imports of 
cigarettes of lead international brands into the Balkans since the early 1990s. The schemes 
range from duty free imports to entirely illegal methods such as the collection with boats of 
cigarettes thrown out in the sea from ships. The Greek hub is of European importance, as it 
supplies the largest illegal cigarette markets in Europe: the UK, the Netherlands, Germany and 
Central European countries. 
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between large importers/manufacturers and Bulgarian mid-level criminal entre- 
preneurs. 


Despite this evolution of criminal networks engaged in cigarette import and 
distribution between 2009 and 2011, increased control at the Bulgarian — Greek 
border and a number of seizures of large volumes of illegal cigarettes forced 
smugglers to abandon the import of large quantities in containers. They started 
importing smaller quantities, including through the green borders. The importa- 
tion of illegal cigarettes with forged documents through the Turkish border has 
also been significantly disrupted by law enforcement. 


At the same time, the consumption of illicit whites in Bulgaria has been gradu- 
ally overtaken by illegal cigarettes of legitimate well-known local brands. The 
quantities of illicit Karelia (Greece), or King Tobacco (Bulgaria) cigarettes seized 
by the authorities have increased.5”7 The same brands dominate the data col- 
lected by the empty pack surveys. This tendency presents a significant threat, as 
the sources of this type of illegal cigarettes are local producers with large share 
of the legitimate market. 


5.3. Risks and harm 


The risks and harm differ according to the size of the administrative region of 
Bulgaria, its proximity to international borders, local criminal traditions, as well 
as the operational activity and level of control imposed by local police and 
customs. 


Table 6 below shows the estimated turnover generated by illegal cigarette trade 
by administrative region, as well as the estimated number of distributors. This 
assessment is based on the average number of illegal cigarette packs estimated 
to have been sold per month in each area. For instance, in the biggest market 
for illegal cigarettes, Sofia, the average daily sales of between about 80,000 packs 
generate a monthly turnover of €2.45 million.% 


The illegal distribution of tobacco products is a growing threat, especially 
since over the past 10 years the dependence of the government budget on 
excise taxes has grown immensely. In 2010 and 2011, the revenue from 
excise taxes accounted for 8.0 — 8.2% of all tax revenues to the state 
budget. In most Western EU member states excise taxes form only 1.5% of 
the state budget revenues. In 2010, the Ministry of Finance expected VAT and 
excise revenues from tobacco products to provide 15% (€1.47 billion) of the 
total budget revenues. Instead, they provided only for 9.57% (€0.93 billion). 
The market for illegal cigarettes in 2010 represented 0.85% of the country’s 
GDP. For comparison, the revenues from illegal cigarette trade amount to 
€5.5 billion in Germany and €4.2 billion in the UK which is equivalent to 
0.2% of their GDP. 





587 Such cigarettes seized by authorities or detected in empty pack surveys usually bear a “duty 
free” stamp or non-Bulgarian language warning signs, indicating that they have been meant for 
export or actually exported and smuggled back in Bulgaria. 

8 The estimates are based on analysis of the decline in regional sales of legal cigarettes between 
2008 and 2011, as well as on differences in the level of consumption for the same period. 
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TABLE 6. ESTIMATED TURNOVER OF THE ILLEGAL CIGARETTE DISTRI- 
BUTION BY ADMINISTRATIVE DISTRICT 


Sofia city 75 — 80,000 790 — 1,580 90 — 160 
Plovdiv district 45,000 450 — 900 45 — 90 
Burgas district 42,000 420 - 845 42 — 85 
Varna district 32,000 320 — 640 32 — 64 


Districts Stara Zagora, Pazardzhik, 15 — 23,000 150 — 460 
Pleven, Blagoevgrad, Dobrich, 
Haskovo, V. Tarnovo, Ruse 


Sofia region, districts Vratsa, Shumen, 8 — 14,000 0.26 — 0.46 
Montana, Razgrad, Targovishte, Vidin 


Districts Pernik, Yambol, Lovech, 5 — 7,000 0.17 — 0.24 
Kyustendil , shuttle traders, Gabrovo, 
Sliven, Smolyan, Silistra, Kardzhali 





Source: Estimates based on data on official sales from three major tobacco companies (2008-2011); data on consumption from the National 
Crime Survey and market retail surveys. 


The illegal cigarettes market also brings social harm as it creates conditions for 
illegal employment of a large number of people (approx. 15,000). Despite down- 
ward trends, at least 400 — 500 thousand people are expected to continue to 
consume illicit tobacco products in the near future. The mass scale of this 
criminal activity creates a certain culture of illegality and a grey zone which is 
comparable to the effect of the prohibition of alcohol in the US in the 1920s. 


In the long run, there are also threats related to the potential growth in involve- 
ment of Bulgarian criminals in international criminal structures related to ciga- 
rettes contraband and increased violence related to turf battles in the domestic 
market. 


The illegal distribution of tobacco products is a generator of corruption, which 
in some regions affects various levels of the law enforcement institutions, customs 
and the judiciary. In some cases entire shifts of customs officers, security police 
officers, mid and high level police officers receive additional monthly payments 
from the illegal trade in tobacco products. The private sector is also affected by 
corruption, where private security personnel in public and _ private institutions 
engage in retail distribution of illicit cigarettes. 


The increasing share of cigarettes sold without excise stamps, produced by large 
Bulgarian manufacturers also presents a serious political risk. 


6. THE MARKET FOR ILLEGAL OIL PRODUCTS 


The oil products market is the biggest legal market in the country, amounting 
to €4 — 4.5 billion annual sales to end customers. The revenues from excise 
duties and VAT on oil products are the largest contributor to the state budget 
(larger than corporate or personal income tax revenues). Over the past five years 
the excise revenues from petroleum products provided between 47% and 50% 
of all excise duty revenues, according to the Ministry of Finance. 


In 2011, the revenues to the state budget from excise taxes on oil products 
amounted to €0.95 billion. In addition, the expected revenues from VAT on the 
basic fuel types (diesel fuel, petrol, liquefied petroleum gas) were in the range 
of €800 - 900 million. The significant size of the domestic fuels market and 
high levels of expected tax revenues create a risk of significant losses for the 
state budget even if the percentage of illegal sales is relatively small. The har- 
monisation of the Bulgarian excise taxation levels with those in the EU, in 
combination with the rise in oil prices globally, determined the growing demand 
for illegal fuel over the past few years. This illegal market not only poses a great 
financial threat to the state budget but it affects negatively competition in trans- 
portation and construction industries. 


6.1. Scale of the problem and trends 


International oil companies operating in Bulgaria estimate the share of the illegal 
sales of oil products at between 20% and 40% of the market, equalling an 
annual turnover of €0.8 — 1.8 billion.% 


Estimates for the period 2007 — 2009 show that the sales of diesel fuel formed 
the largest segment of the illegal fuels market (Table 7). The differences between 
officially registered sales and the actual consumption are in the range of 32% 
to 39%. 





°° The lack of comparable data from independent sources is a hindrance to the assessment of 
the illegal fuel market. Unlike the markets for other excise goods, market surveys on oil prod- 
ucts (retailer surveys or self-assessments of end users) are incomplete or inaccessible. The main 
source of information is the data provided by the Customs Agency or the National Revenue 
Agency, as well as the statistical data on energy consumption by the National Statistical 
Institute. These alternative data avenues cover only part of the fuel consumption, and do not 
include studies on large consumers of petrol products, such as companies in the transportation, 
industrial production or construction sector. There are no reliable methods for assessment of 
illegal sales, comparable to the use of the empty cigarette packs studies used in the assessment 
of the illegal cigarette market. 
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ASSESSMENT OF THE SIZE OF THE ILLEGAL FUEL MARKET 








Actual 2,557,617 627,505 
Declared 1,726,000 597,000 
Undeclared 831,617 30,505 
% of undeclared 325 4.9 
Actual 2,816,161 655,988 
Declared 1,730,000 598,000 
Undeclared 1,086,161 57,988 
% of undeclared 38.6 oF, 
Actual 2,485,257 624,619 
Declared 1,697,000 616,000 
Undeclared 788,257 8,619 
% of undeclared Bley 1.4 


Source: Calculations based on National Statistical Institute data on energy balance and other statistical data; consumer surveys 


Available data also show that the overall consumption of diesel fuel decreased 
after 2009 (Table 8), despite the economic growth and rising exports in 2010 
and 2011. 


TABLE 8. VOLUME OF DIESEL AND PETROL WITH PAID EXCISE DUTY 


Fuel /thousand litres/ 2,323,000 2,328,000 2,313,000 2,432,599 2,319,890 





Source: National Statistical Institute (data for 2007-2009), Customs Agency (data for 2010-2011) 


Between 2010 and 2011 the illegal fuel market shrank due to a number of 
factors: 





60 The calculations are based on actual fuel consumption according to official data on energy 
consumption provided by the National Statistical Institute (NSI). The actual consumption is 
calculated based on the number of motor vehicles and their average annual fuel consumption. 
This estimate is based on a detailed typology of vehicles in order to achieve an accurate 
assessment of the various differences in consumption, average annual mileage. Vehicles with 
suspended licenses and those older than 20 years were excluded from the calculation. In 
addition, the results were reduced by 30%. 
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e Market surveys show that due to several macroeconomic factors and the high 
oil prices the fuel consumption dropped in 2010 by 4%, following a 10% 
drop in the year before. 


¢ In 2011, a number of measures targeting fictitious exports resulted in a drop 
of the excise tax recovered by fuel exporters by €100 million compared to 
2010. At the same time, given a 41.5% increase in the volume and value of 
intra) community trade and exports of fuels, it can be assumed that the 
decreased levels of recovered fuel excise taxes indicate decreased losses from 
fictitious exports.” 


e Data by the National Revenue Agency (NRA) showed that the installation of 
a real time connection between the NRA and the registers of more than 3,000 
petrol stations led to a 20% increase of declared sales by ‘white pumpers’ 
(smaller independent distributors with less than 6 petrol stations). This trend 
concerns only one part of the illegal market for oil products. Petrol stations 
sell fuel products mainly to individual customers and small companies. The 
major end consumers of illegal diesel were unaffected by this measure, as in 
most cases they run their own internal petrol stations. 


Organisation and structure of the illegal market 


Various players are involved in the illegal market for oil products. Although some 
tax avoidance schemes originate within legitimate companies, the direct partici- 
pants in the criminal schemes are often fictitious traders at the wholesale or 
retail level. Criminal networks which do not use a legitimate business structure 
as a front are rather the exception. The reason is that unlike the trade in other 
excise goods, distribution and sale of oil products requires certain infrastructure 
which cannot be easily concealed. Not all illegal fuel smuggling and trade is a 
form of organised crime. Often, individual companies or private individuals may 
illegally import fuel for their own consumption. 


Unlike petrol, the illegal diesel fuel is mainly sold outside regular petrol stations. 
The main consumers of illegal diesel are companies whose competitiveness 
depends on fuel costs (mainly construction and transport companies). 


The most common schemes are related to avoidance of VAT payments, while 
the excise duties are paid. Some frequently used schemes include: 


e The fuel products are officially imported, the excise duty is paid. The fuel is 
then resold to fictitious companies usually nominally owned by poor and 
marginalised individuals. These companies sell the fuel without paying VAT. 


¢ Derivatives levied with higher excise duties (obtained by processing of oil 
products levied with low excise duties) are sold by producers without docu- 
ments or with forged documents (e.g. showing that the product is not subject 
to high excise duty). The payment of VAT and excise duties is thus avoided. 





61 The measures introduced by the Customs Agency included introduction of mandatory elec- 
tronic measuring equipment on all fuel storage facilities in the country, directly linking to the 
Agency’s monitoring system. All fuel-tank trucks were also installed with GPS equipment linking 
to the database. 


48 


6.3. 


Harm 


The Market for Illegal Oil Products 


e Marked fuels for heating or agricultural purposes is redirected and sold to 
illegitimate users (e.g. transport companies or private individuals), thus with- 
holding part of the excise duty. 


¢ Imported oil products (including intra community deliveries) are actually sold, 
but the paid VAT is compensated by purchases of fictitious goods and serv- 
ices from phantom companies. The value of the purchase equals the value 
of the imported fuel. 


e Fictitious refuelling of river and sea vessels (‘bunkering’): during refuelling of 
ships in ports or outside the territorial waters (of fishing vessels) the fuel is 
re-imported and sold. 


Another major source of illegal oil products is the fictitiously exported diesel 
fuel from domestic production. A network of companies purchases the fuel 
and registers it as exported at their own risk, using corrupt customs officials. 
There are two options — the export is only on paper, or the fuel actually 
crosses the border and is smuggled back in the country, while the containers 
are documented as empty. It is subsequently sold to industrial consumers, 
transportation or construction companies, which through their internal petrol 
stations use it for their own needs. This scheme is extremely difficult to 
uncover, as the transactions are conducted only by high-level employees of 
the companies involved. Furthermore, the fuel is mixed with diesel on which 
excise taxes and VAT have been paid. Sea and river borders in particular 
pose a great risk of smuggling. 


As outlined above, the diesel fuel trade accounts for 95% — 98% of the mar- 
ket for illegal oil products. The illegal diesel fuel market is estimated at 26% —- 
35% of all sales in 2010 and 2011® or between 800 million and 1 billion 
litres annually.6* Consequently, the losses to the state budget are in the range 
of approximately €300 million in unpaid excise duties and €240 million in 
unpaid VAT. 


The illegal sales of diesel fuel generate between €280 and €430 million per 
year. The companies using illegal fuel decrease their costs and pose a risk to 
the competitiveness of regular fuel buyers. 





6 Such fuel is usually coloured in a way that allows authorities to detect that it is meant to be 
used for heating rather than transport. 

6 These are preliminary estimates, based on the 2009 data provided above. The calculation also 
takes into account data on paid excise duties (see Table 3), as well as data on change in 
consumption for 2010 and 2011. 

64 The more conservative forecast of the size of the illegal market is from the National Revenue 
Agency, which assumes that the 2011 fall in diesel fuel consumption (as indicated by the 
Customs Agency data), as well as the measures undertaken by the NRA and the Customs have 
resulted in a contraction of the illicit diesel market back to the 2009 levels. The argument put 
forward by CSD analysts is that in 2011 the size of the illicit fuels market increased beyond 
the 2009 levels due to the growth in the grey economy, the increase in international road 
transport (due to booming exports), and high oil prices. 

6 The estimate is based on intelligence data suggesting that the price of 1 litter illegally sold 
diesel is 20 — 30 cents cheaper than the legal sales. 


Serious and Organised Crime Threat Assessment 49 


6.4. 


Forecast 


The trend of increasing international oil prices is likely to continue over the 
next three years. The planned hikes of excise levels on some fuels, diesel in 
particular, would put additional price pressure on end users. Under continu- 
ing economic stagnation these factors will create growing demand for illegal 
diesel fuel. 


The involvement of illegal fuel distributors that are part of or associated with 
former major racketeering structures poses a long term risk to the fuel market. 
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COUNTERFEITING OF PAYMENT MEANS 
AND BANK CARD FRAUD 


Trends 


The counterfeiting of means of payment and crimes related to electronic pay- 
ment instruments include two criminal activities that are different in terms of 
structure, technology and participants: production of counterfeit banknotes and 
theft of bank card data. The second category also includes cyber-crimes involv- 
ing drawing on bank accounts through the internet. The victim of all these is 
the banking system. 


Of these crime categories, crimes related to electronic payment instruments 
pose the most significant threat. Over the past few years many car thieves and 
other criminal entrepreneurs with technical skills and international experience 
were drawn to this criminal activity which many found to be low-risk. The 
victims of these crimes include mostly foreign citizens and banks. The threats 
from offences related to electronic payment instruments and internet fraud 
related to bank accounts are insignificant in financial terms compared to other 
European countries. 


Due to joint law enforcement operations by the Bulgarian police and the US 
Secret Service over the past years, Bulgaria ceased to be one of the main hubs 
for production of counterfeit dollar bills. Furthermore, although there are some 
printing shops for counterfeit euro bills left in Bulgaria their output has become 
much smaller.% 


According to data from the European Central Bank and the US Federal reserve, 
the global scale of production and distribution of counterfeit dollars and euros 
has remained relatively stable over the past few years. Data from the Bulgarian 
National Bank (BNB) show that the registered volume of counterfeit euro bills 
in 2011 is larger than the year before. At the same time the detection in 2010 
of a large printing house producing counterfeit Bulgarian levs led to a fivefold 
drop in the volume of counterfeit Bulgarian levs identified by the BNB in 
2011. 


Data provided by a number of banks, as well as the National Crime Survey 
(NCS), indicate that the number of victims of electronic payment instruments 
fraud has increased over the past years.°’ The size of this criminal activity in 
absolute terms still remains low compared to Western Europe: NCS indicates 





66 Five such printing shops were uncovered by the Bulgarian police in 2010 and 2011. 

87 The National Crime Survey indicates that the latency of these crimes remains high — only 30% 
of all victims reported to the police. However, 94% of them reported the crimes to their 
banks. 
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that in 2010 only 0.9% of all card holders became victims of bank card-related 
crimes (6.4% in the UK in 2009, according to the Home Office). 


Due to the relatively small sums held in bank accounts and the low limits on 
cash withdrawals in Bulgaria, criminal networks prefer to target foreigners who 
use ATMs (automated teller machines), usually in tourist areas. In 2011, only 
44% of the population possessed bank cards (50% in 2010). Bank card holders 
used their cards for payments or purchases much less frequently than consumers 
in the EU. 


In the past two years, skimming devices placed by Bulgarian criminal groups 
have been registered in most EU countries and the US. The withdrawal of funds, 
using stolen bank card data, takes place in countries where the ATMs and POS 
(point of sale) terminals do not maintain the global EMV standard®® for inter- 
operation of chip cards (Caribbean, Africa, South America and Australia). In 
Bulgaria about 26% of the cash withdrawal machines still do not comply with 
the EMV standard (in most EU countries the compliance with EMV is in 100% 
of the cases). This means that the country remains an attractive target for crim- 
inal networks. 


The theft of card data over the internet inflicts even smaller financial losses than 
the credit card skimming. There are limited opportunities in Bulgaria for sub- 
stantial income from this type of crime. Eurobarometer’s survey indicates that in 
2010, only 5% of the population used the internet to purchase goods and/or 
services, while in the EU the percentage is 40%. The usage of online banking 
in 2010 - 2011 remained unchanged, and is at the lowest level in the EU at 
only 3.5% of the population. In the Netherlands and the Nordic countries over 
50% of the population uses online banking.% 


7.2. Structure and organisation of the illegal activities 


The criminal networks engaged in counterfeiting of banknotes and bank cards 
differ substantially in structure and organisation. The production of counterfeit 
banknotes requires bigger investments in printing equipment and paper. In most 
cases it is linked to some legal printing activity, but also to other types of ille- 
gal printing (counterfeit vignette stickers, excise stamps for cigarettes). The distri- 
bution is often carried out by separate criminal structures within the distribution 
network of EU countries. 


The theft of bank card data requires much smaller investments and a simpler 
structure. There are a number smaller groups operating, as well as some larger 
criminal groups who operate on several continents and generate substantial prof- 
its. The technical skills required for manufacturing of a skimming device are not 
particularly sophisticated. There are several regions within the country besides 





68 The global EMV standard is a joint effort of Europay, Mastercard and Visa to ensure security 
and global interoperability of IC cards (‘Chip cards’) and IC capable POS terminals and ATM's, 
for authenticating credit and debit card payments. EMV financial transactions are more secure 
against fraud than traditional credit card payments which use the data encoded in a mag- 
netic stripe on the back of the card. 

69 Eurobarometer (2011): Special Eurobarometer 359: Attitudes on Data Protection and Electronic 
Identity in the European Union 
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Sofia known for the production and distribution of skimming devices (Silistra, 
Ruse, Plovdiv Burgas, Stara Zagora). The risk of detection is higher at the lowest 
levels of the criminal structure — the people that withdraw cash from ATMs with 
counterfeit cards, those who transport and install the skimming device, or the 
usually low income proxies to whose accounts criminals transfer the money 
stolen through phishing-type fraud. 


According to the European Central Bank in 2010 about 364,000 counterfeit 
banknotes worth €21 million were withdrawn from circulation. Official estimates 
from the US show that the counterfeit dollars in circulation globally have a total 
value of between $60 and $80 million. 


Given the high production costs and the discount at which producers sell coun- 
terfeit banknotes for distribution, the revenues of organised crime in Bulgaria are 
in the range of a few million Bulgarian levs. The losses related to data theft with 
counterfeit bank cards are much higher. Europol estimates the losses for the EU 
in 2011 at €1.5 billion. In 2006 — 2007, the losses in the US ranged between 
$6 and $7 billion per year. 


Bulgarian banks’ losses caused by internet fraud and counterfeit banknotes or 
bank cards are considerably lower than those of banks in other countries, or 
compared to other types of fraud affecting the banking sector in the country. 
Data from some of the biggest banks in Bulgaria showed that losses to indi- 
vidual banks are well under €1 million per year. 


The harm, therefore, falls into three categories which are not measurable in 
financial terms: (1) the country’s image is damaged due to the large number of 
Bulgarian criminals operating internationally; (2) a significant portion of the prof- 
its generated through counterfeiting/account data theft are laundered in Bulgaria; 
(3) this type of illegal activity is often used as a source of financing of other 
criminal activities. 


There are no economic or other factors that can lead to an increase in the 
production of counterfeit banknotes in the upcoming years. This illegal activity 
is not expected to pose any significant threats to the Bulgarian banking system, 
at least until the country’s Eurozone entry. 


Card-related fraud will continue to affect the banking system in Bulgaria, 
although there is a declining tendency in the EU as a whole. This threat stems 
from the large growth potential in online banking and bank card use in Bulgaria. 
In 2010, the bank card payments have increased by 45% on an annual basis, 
while the average number of transactions rose by 25.3%. 


The criminal prosecution of offences related to counterfeiting of payment meth- 
ods faces a number of obstacles which could encourage the involvement of 
organised crime in this illegal activity. Part of the criminal activities (the skimming 
and withdrawals from bank accounts) take place outside the country and the 
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victims are also based in other countries. The technical aspects and untradi- 
tional forensics create difficulties for the prosecution. As a result, the general 
impression amongst judges and prosecutors is that the counterfeiting of payment 
methods poses a low threat to society. 


The significance of bank account fraud through the internet is unlikely to 
increase due to the low level of online banking usage in the country, as well 
as increased security measures implemented by banks in Bulgaria. Internet shop- 
ping is growing rapidly. Although the economic crisis might slow down. this 
process, the vulnerability of the Bulgarian banking system is likely to gradually 
increase. 


8. 


8.1. 


LOAN SHARKING AND EXTORTION RACKETEERING 


Trends 


Illegal lending — known as loan sharking — is one of the serious threats that 
society faces. Victims of loan sharks are individuals as well as companies. Loan 
sharks usually lend money to firms operating in the grey economy which cannot 
resort to legal banking. They constitute an important part of the financial infra- 
structure that has maintained the high level of the grey economy for almost two 
decades. Loan sharks fund different levels of organised crime as well: from petty 
criminals to high-level transactions of illegal goods. 


By controlling a big share of socially disadvantaged people in some communi- 
ties — especially small towns and Roma communities — they undermine the 
democratic processes, becoming a key player in the process of votes rigging 
during local government or parliament elections. The participation in loan shark- 
ing of legal entrepreneurs or prominent personalities facilitates corruption. 


The collection of debts accrued through loan sharking intertwines with extortion 
racketeering. Though the role of the extortionist security firms of the 1990s is 
incomparable to the current state of the private security sector, there are secu- 
rity companies that are still controlled by organised crime. They are also related 
to some forms of racketeering and debt collection. 


Over the past two years, loan sharking has become well established. Several 
factors contributed to the rising demand of this service as well as the provision 
of illicit loans. In the first place, it is the economic crisis that has made a grow- 
ing number of people and companies encounter difficulty in servicing their debts 
to banks and other financial institutions. In 2011, overdue long term debts went 
up to 15% of the total credit portfolio of banks. Private individuals and com- 
panies went into the grey economy which deprived some of them of access to 
licit financial resources. These two factors have led to the rising demand for 
illicit forms of financing. 


The drop of real estate value made real estate development and trade unattrac- 
tive investment opportunity for criminals. Loan sharking turned into a very attrac- 
tive investment alternative for both criminals (mainly those involved in drug and 
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cigarette distribution, trafficking in human beings) and legitimate businessmen. 
They became the main source of capital for loan sharks. 


Over the past decade, extortion racketeering has been decreasing. According to 
the National Crime Survey (NCS), in 2005, 9% of the companies fell victim to 
racketeering, while in 2010 their number dropped to 3.3%. The share of extor- 
tions for money also decreased. In 2005, 56% of extortion cases were for 
money, in 2010 their percentage fell to 43. 


Some of the loan sharks were really active during the local elections in 2011. 
Local oligarchs” resorted to their influence over socially disadvantaged and debt- 
ors in attempt to manipulate the election results. 


With the increasing debts of citizens and companies, some illegal forms of debt 
collection gained momentum, such as resorting to different forms of intimidation 
and even violence. On the one hand, some traditional debt collection services 
by private security companies were revived. On the other, some legitimate com- 
panies for debt collection increased their use of illegal methods of coercion to 
collect debts. 


8.2. Structure and organisation 


Loan sharking is a well-established business in almost all cities of the country: 
ranging from small towns with several loan sharks to big regional cities with 
dozens of such individuals. Some communities with high unemployment rates 
are badly affected and in practice there is no Roma neighbourhood without at 
least one loan shark. 


Some loan sharks work under the cover of legitimate business structures: finan- 
cial institutions,” pawn shops or even food stores. These businesses are used to 
identify prospective victims and launder profits. Other loan sharks operate 
entirely illegally. In most cases loan sharks operate only in part with personal 
funds, with the rest of their capital borrowed from (criminal) entrepreneurs. 
Some loan sharks are not part of organised criminal networks and run their own 
operation and interface directly with victims. In other cases they operate as part 
of networks and hierarchical structures. In the latter case, only loan sharks at 
the lowest level give loans directly to the user, while profits are shared with 
higher-level loan sharks. Each level in this structure lends to the lower level at 
higher interest than they have borrowed the money. At the lowest level interests 
may reach 100% per month. Capital controlled by loan sharks at the highest 
level may exceed €500,000. 


Loan interest rates vary a lot and many factors are considered in their for- 
mulation. Loan guaranties used include are (1) property mortgage contract in 
favour of the loan shark; (2) promissory notes; (3) debit cards with their PINs 





70 Oligarchs are businessmen, who own companies thriving on public contracts from the local 
administration for waste disposal, maintaining roads, public construction and renovation 
projects. 

71 The public register of financial institutions of the Bulgarian National Bank indicates that there 
are about 137 registered firms which claim to provide “loans coming financial resources col- 
lected in ways other than public deposits and other reimbursable funds.” 
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(the state usually pays pensions and social assistance directly to bank accounts 
with debit cards); (4) valuables (gold, cars). 


The financial harm inflicted by loan sharks is difficult to measure but given the 
estimated turnover of tens of millions of levs, victims may pay millions of levs 
in interest rates. The significant point here is the social damage caused by loan 
sharks. Very often the financial situation of the victims gets worse after taking a 
loan from a loan shark. In some communities loan sharks establish economic 
and political control because a large portion of the population — up to 10% of 
the population of small towns and 50% of the population of some Roma com- 
munities — becomes dependent on their services. 


The most worrisome damage of loan sharking is the undermining of the elec- 
toral process. Some loan sharks have been known to be closely linked with 
local political parties, which allow them to get protection from the ranks of 
elected politicians. Other loan sharks are used by local businessmen as inter- 
mediaries in purchasing votes during local elections. Such businessmen then 
use the political clout to win public contracts (usually in construction, waste 
collection). 


The forecasts of financial institutions are that in 2012 and 2013 bad loans in 
the banking system will continue to rise and reach 17% of the total bank port- 
folio. That means that the demand of illicit loans would keep its high and sta- 
ble rates. 


With the growing number of debtors, an assumption could be made that loan 
sharks would have larger resources at their disposal to manipulate the electoral 
process during the upcoming Parliamentary elections in 2013. 


9. 


O15 


VEHICLE THEFT 


Trends 


The threat from criminal groups related to car theft has substantially declined in 
recent years. Bulgarian criminal networks are involved in the theft of vehicles 
within the country, as well as in international trafficking. Most vehicle thefts in 
Bulgaria are related to organised crime.7? Usually passenger cars are stolen but 
also trucks, motorbikes and construction equipment. While in the 1990s the 
massive scale of car-theft attracted some non-professional car-thieves, today it is 
mainly an organised crime activity. Stolen vehicles are used for the following 
purposes: 


¢ to be sold on the local used-car market or exported and sold in Western 
Europe, the Middle East, or the former Soviet Union; 


¢ to be sold for spare parts in car scrapyards; 
¢ to be disposed as scrap metal; 

e to commit other crimes; 

® to extort ransom from the car owner.” 


The different reasons for stealing a vehicle indicate that car-theft is linked to 
several legitimate markets: of used and new cars, the spare vehicle-parts market, 
and the scrap metal market. Therefore, this activity is related to the entire eco- 
nomic situation in the country. 


After a high point of almost 15,000 stolen cars per year in the mid-1990s, car- 
theft dropped to 3,802 in 2010 and then to 3,200 in 2011. The clear downward 
trend in vehicle thefts over the 2009 — 2011 period is partially due to the over- 
all decline in demand for used and new cars in Bulgaria. The economic crisis 
and high unemployment rate also affect the car market (for both new and sec- 
ond hand cars) which was in stagnation in 2011. On the other hand, the eco- 
nomic crisis stimulated various other forms of crime, such as insurance and lease 
fraud related to cars. Despite the abolition in 2007 of physical controls over the 
transfer of vehicle registration, there are other preventive measures contributing 
to the decline in thefts. In 2010, the Ministry of Interior, the Guarantee Fund 
and the Financial Supervision Commission started to use a common information 
database where all total damages paid by car insurers are registered. This meas- 





72 In Bulgaria joy-riding thefts are very rare. 
73 In 2000 - 2005, these reached over 50% of all car-thefts. See: Center for the Study of 
Democracy (2006), Crime Trends in Bulgaria 2000 — 2005, Sofia, CSD. 
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ure impacted car insurance fraud, as well as vehicle theft. Furthermore, the 
authorities started to conduct regular inspections of car scrapyards. Car owners 
encountering financial difficulties sold their cars to thieves to collect insurance 
pay-outs or reduce their lease-related debt.“ Low car demand forced some 
thieves to shift from the theft of luxury to the theft of low-priced cars. 


Data from the National Crime Survey shows that over the past few years there 
has been a decrease in ransom-related car thefts, mainly because of the low 
prices of used-cars and the improvement in the system of car-theft insurance 
payouts. Meanwhile, the increase in the price of scrap metal has led to more 
stolen cars being sold for scrap metal yards. The stagnation of the car market 
increased the demand for spare parts which affected the number of stolen cars 
and sold to ‘chop shops.’ As far as international traffic to and via Bulgaria is 
concerned, there are relatively low rates of theft committed in Western Europe 
due to the drop in demand in Bulgaria and criminals’ shift to other types of 
crime. 


9.2. Criminal structures 


Vehicle theft is only one aspect of the illegal business of criminal networks. They 
are concentrated in administrative region capitals, big cities and tourist resorts, 
and in Sofia, where 50% of vehicle thefts occur. With the fall in used-car 
demand in the past few years, many car thieves turned to other criminal activ- 
ities, mainly to bank card fraud. 


Car theft for the purposes of scrap metal recycling and spare parts, as well as 
the theft of mid-sized family cars are often committed by small and mostly ad 
hoc criminal groups. Luxury car-theft or thefts related to ransom seeking, on the 
other hand, involve more complex criminal networks. 


The theft of luxury cars is organised by criminal entrepreneurs who usually 
have legal business structures and connections that allow them to export the 
stolen car abroad or sell it in Bulgaria to affluent customers. These entrepreneurs 
are likely to hire small crews of professional car thieves who commit the theft, 
transport the stolen vehicle and arrange its sale. The theft crews may only have 
one professional or technically savvy thief. Other crew members are involved 
in supporting activities, such as: surveillance, support during the theft, transpor- 
tation to another city in Bulgaria or abroad, replacing identification numbers 
(mechanics/car servicing workshops), forgery of documents, registration of the 
stolen vehicle, and its resale. Bulgarian criminal networks abroad (e.g. in Spain 
or Italy) are structured in a similar way: car theft crews are hired by locally 
established criminal entrepreneurs funding the car theft. These entrepreneurs are 
usually in contact with used-car dealers or other criminal entrepreneurs in 
Bulgaria who arrange the sale or the export of the vehicle towards other coun- 
tries. Investigating the entrepreneurs is difficult due to the fact that in most 
cases the criminal activity is coordinated by their subordinates, and the entre- 
preneurs have no direct contact with the stolen car or the money obtained 
from its sale / ransom. 





7 In Bulgaria lease contracts require the customer to make payments for up 90% even on a 2 
year lease contract, thus leaving minimal repayments due at the end of the contract. 
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9.3. Harm 


Car theft inflicts financial damage to car owners, and insurance and leasing 
companies. In 2010 alone, harm caused by luxury car theft was estimated 
between €7 and €14 million and theft of the lower class cars between €5.5 
and €11.5 million (with a total ranging between €13 and €26 million). 


9.4. Outlook 


The likelihood of a protracted economic slump in Bulgaria and the EU means 
that there will not be significant changes in the trends in vehicle theft. The 
increasing role of the internet in the sale of stolen vehicles and as well as in 
the procurement of electronic devices for decoding of car immobilizers need to 
be taken into account. 





75 In contrast to Western Europe, in Bulgaria the average value of stolen cars is lower due to 
the fact that most are sold for scrap metal, spare parts, extortion or commitment of other 
crimes. Only 20% of stolen cars cost more than €7,500. 


10. 


10.1. 


LAUNDERING THE PROCEEDS OF CRIME 


Trends 


Money laundering is where all criminal markets and activities intersect with the 
legal economy, with the aim of legalising the proceeds of illegal activities. There 
are two different streams of criminal proceeds in Bulgaria depending on where 
the crimes had taken place: the first stream comes from crimes committed in 
Bulgaria, while the second comes from crimes committed abroad either by 
Bulgarian or by foreign criminals who may use Bulgaria as a money-laundering 
destination. 


There are two general factors that determine money laundering trends: develop- 
ments in the illegal markets, and the broader financial and economic environ- 
ment. The conclusion from the trends in the various illegal markets outlined in 
previous chapters is that in the past two years there has been a decline in the 
overall volume of laundered proceeds. Several factors, related to the economic 
downturn in 2009 — 2011, led to restructuring of the streams of revenues from 
criminal activities: 


e The continuing decline in foreign direct investments (FDI) in Bulgaria: FDI 
dropped 48.3% between January — November 2011 compared to the same 
period in 2010. 


¢ The downturn in the construction sector narrowed the opportunities of using 
real-estate development as a way of laundering criminal money, as compared 
with the period before 2009. Part of foreign real-estate investments are car- 
ried out via offshore companies’ accounts in foreign banks, which makes it 
difficult to establish the actual beneficiary.” 


e Despite the general drop in the volume of trade on the Bulgarian Stock 
Exchange, the growing size of trade in the unofficial segment (the unofficial 
regulated market) and in the over-the-counter trade in 2010 and 2011 were 
perceived as an emerging risk for money laundering.” 


The world economic and financial crisis highlighted the changing patterns in the 
interaction between criminal money and the banking sector. As a result of the 
crisis and liquidity issues that the banking sector faced, many financial institutions 
resorted to survival tactics, such as lowering due diligence standards and grow- 
ing reluctance in reporting suspicious transactions out of fear of scaring away 
potential clients. 





76 State Agency for National Security (2011), Extract from the Annual report on national security for 
2010, p. 25. 
7 |bid., p. 27. 
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10.2. Structure and organisation 


A good part of the proceeds generated from organised crime is laundered using 
very simple schemes. The majority of the participants in the illegal markets do 
not generate enough financial resources that even require money laundering. In 
the illegal cigarettes market, for instance, the money left to be laundered does 
not exceed 15% of all proceeds (or €30 million out of €200 million total mar- 
ket turnover). The majority of illegal market actors are at the retail level where 
they hardly earn enough to support a modest standard of living. Even at the 
whole-sale level some participants maintain luxury lifestyle and fund other 
criminal activities, instead of laundering the criminal proceeds. At the mid-level 
of criminal markets criminals often buy small real estate property or start a busi- 
ness, which in most cases supports the criminal activity or money laundering 
itself — entertainment facilities, construction, transport, hospitality industry, agri- 
culture, etc. 


Only at the higher level of criminal networks (e.g. VAT fraud schemes) the laun- 
dering of proceeds may involve more complicated schemes that include offshore 
companies and/or complex financial instruments such as the stock exchange. As 
the majority of the offshore financial centres have strict banking secrecy laws, 
they are attractive to criminal networks. Internet banking has further facilitated 
the management of criminal proceeds placed abroad. 


In 2010, investing money of illicit origin was mainly focused on four distinctive 
sectors: 1) trade (including dealing in real estate property) - 31%; 2) construc- 
tion — 27%; 3) gambling - 18%, and 4) tourism -— 10%.% The money is 
invested using different schemes and pertains to crimes committed either abroad 
or in Bulgaria. 


During the past 20 years money laundering was not a law enforcement priority 
and the majority of the criminal entrepreneurs in Bulgaria have established some 
forms of legal business. In the field of organised tax fraud the use of legitimate 
business structure is a necessary part of the criminal activity. But even in other 
forms of organised crime (narcotics, prostitution, racketeering, etc.) the majority 
of the criminal groups control some legal business structure.”? Bulgarian criminal 
groups participate in the legal economy at higher rates than groups in 
Western Europe. This represents a challenge to attempt to investigate money 
laundering and to uproot corruption. 





78 State Agency for National Security data. 
77 In most of the cases the assets or the real estate are transferred to their parents or close 
relatives, or to other proxies. 
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FiGure 8. THE LEGAL BUSINESS OF ORGANISED CRIMINAL 
GRoups (N= 101)®° 
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In some cases this business is used as a logistical support for criminal activities 
and for money laundering itself. Therefore the type of legal business structure 
sometimes depends on the illegal activities of the group. For example, drug 
traffickers, cigarettes smugglers, or human traffickers may invest in transportation 
companies; human smugglers may use legally registered firms to employ immi- 
grants; shops are used for distributing illegal excise goods, etc. 


The more complex money laundering schemes both in Bulgaria and abroad 
include the use or misuse of the banking system, currency exchange offices, and 
financial companies. In the last years, one of the most widely used schemes 
involved obtaining mortgage to buy real estate property, which is then repaid 
with money from criminal activities. Among the other widely used money laun- 
dering schemes in Bulgaria is claiming profits from gambling; or declaring rev- 
enues from profits from stock exchange trades. The majority of the complex 
money laundering schemes involve notaries, accountants, lawyers, and_ financial 
experts. In larger criminal groups bosses may assign the control of such opera- 
tions to particular persons. There are no specialist money launderers who provide 
money-laundering services to other criminals. 


10.3. Harm 


The socio-economic harm includes effects such as: 





80 The analysis of a sample of 160 criminal groups, whose main criminal activity was drugs traf- 
ficking, trafficking in people, counterfeit currency, illicit arms production / trafficking. The data 
showed that 101 groups (or 2/3 of the total) had a legal business. 
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10.4. Outlook 


Laundering the Proceeds of Crime 


e Directing significant investments not towards sectors with maximum rates of 
return but towards sectors where the detection of money laundering is dif- 
ficult; 


e Undermining fair competition and increasing the risk for economic bubbles 
in some sectors (e.g. real estate); 


e Price distortion especially in the real estate sector; 


e Increasing the levels of corruption, especially in the private sector with the 
purpose of avoiding AML measures or preventing the issuance of Suspicious 
Activity Reports (SAR). 


The ongoing economic downturn will continue to impact on the banks, which 
means that in a short-term perspective the risks related to the lowering of the 
anti-money laundering standards could be expected. The economic crisis may 
push some professions — lawyers, accountants, notaries — suffering from lower 
demand of their legitimate services to turn to money laundering schemes. Finally, 
the development of internet technologies will lead to the further spread of 
money laundering schemes via the internet. 


11. 


FUTURE RISKS AND THREATS 


The current Serious and Organised Crime Threat Assessment comprises only the 
criminal activities posing the greatest threat and inflicting the most significant 
harm to the Bulgarian society. Anumber of criminal markets were not analysed: 
trade in antiquities, arms trade, illegal gambling, illegal migration, illegal log- 
ging, real estate fraud, corruption in public procurement, including embezzle- 
ment of EU funds. 


In view of all these criminal markets and activities it can be concluded that the 
influence of organised crime over Bulgaria’s economy is significant. Over the 
past decade, despite the continuous decline in the influence exerted by organ- 
ised crime (especially with respect to different forms of racketeering), the share 
of criminal economy continues to pose a serious risk to the legitimate national 
economy, deforming its competitiveness and threatening the democratic function- 
ing of public institutions. 


The main threat posed to Bulgarian society stems from organised criminal 
activities or markets that are at levels significantly higer than in other EU 
Member States: the market for sex services controlled by organised crime (espe- 
cially trafficking in human beings), VAT fraud and the markets for excisable goods 
(mainly tobacco and oil products). A serious challenge remains the use of polit- 
ical corruption by oligarchs. 


The current assessment report was carried out against the background of the 
economic crisis and outlines two types of threats. Traditional threats are relat- 
ed to the emerging of big resilient criminal networks involved in illegal trade in 
tobacco products that could form the architecture of new types of organised 
crime. Non-traditional threats refer to the use of the Internet in the sex serv- 
ices market, in bank fraud or even in car theft, etc. Although extortion and 
racketeering by organised crime are at relatively low levels the risk associated 
with them has not been completely eliminated. 


The socio-economic and political changes taking place in the past several months 
in the countries from the Middle East and North Africa are prerequisites for the 
risk of higher migration pressure on Bulgaria as a country neighboring with 
Greece and Turkey. This risk is associated with the possibility of secondary flows 
of illegal migrants from the Middle East and North Africa, who enter Greece to 
be redirected through Bulgaria after the country’s entry into the Schengen 
area. 


The risk of trans-border tax and customs fraud should not be underestimated, 
given the continuous economic downturn, as well as the increasing trade in 
illegal cigarettes and oil products in neighbouring Greece. 
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